CVE-2026-73683: Authentication Bypass by Capture-replay

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...

CVE-2026-8457: Authentication Bypass by Alternate Name

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

CVE-2026-16206

A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function loadidtoken of the file oauth2provider/oauth2validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the...

CVE-2026-14781

A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the emailverified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but...

CVE-2025-64099: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Open Access Management OpenAM is an access management solution. In versions prior to 16.0.0, if the "claimsparametersupported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the idtoken or ...

EUVD-2020-25708

Malware in sbrugna...

EUVD-2018-12421

Malware in sbrugna...

EUVD-2023-29510

Malicious code in bioql PyPI...

CVE-2023-25558

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the idtoken is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the...

CVE-2023-25558 Deserialization of untrusted data in DataHub

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the idtoken is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the...

CVE-2023-25558

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the "idtoken" is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the...

CVE-2023-25558: Deserialization of Untrusted Data

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the idtoken is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the...

CVE-2020-4461

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing idtoken claims manipulation without verification. IBM X-Force ID: 181481...

Design/Logic Flaw

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing idtoken claims manipulation without verification. IBM X-Force ID: 181481...

CVE-2020-4461

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing idtoken claims manipulation without verification. IBM X-Force ID: 181481...

CVE-2020-4461: Undefined Security Weakness

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing idtoken claims manipulation without verification. IBM X-Force ID: 181481...

CVE-2018-1842: Improper Verification of Cryptographic Signature

IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its idtoken. IBM X-Force ID: 150902...