CVE-2026-108808

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-108808 Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

EUVD-2026-97261

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-108808

A vulnerability exists in Eleveo Call Recording Software up to version 10.3.0 within the JWT Token Handler component. Specifically, the file /auth/realms/default/protocol/openid-connect/logout is affected. By manipulating the id_token_hint argument, an attacker may cause the application to use th...

CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-105118

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105118

OpenAM versions prior to 16.1.3 are susceptible to an open redirect vulnerability. The root cause is the failure to verify the id_token_hint provided to the /oauth2/connect/endSession endpoint. Unauthenticated attackers can exploit this by supplying a forged hint to redirect victims to any regist...

CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

EUVD-2026-92022

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105118 OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

CVE-2026-105118: Improper Verification of Cryptographic Signature

OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified idtokenhint to the /oauth2/connect/endSession endpoint. Attackers can name any realm client in a forged hint to redirect victims to any registered...

Duende IdentityServer authorization issue vulnerability

Duende IdentityServer is an open-source framework developed by Duende for ASP.NET Core, which adheres to standard OpenID Connect and OAuth 2.x protocols. Duende IdentityServer has a vulnerability related to authorization. This vulnerability stems from incorrect handling of the parameter idtokenhi...

CVE-2026-4349: Improper Authentication

A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument idtokenhint causes improper authentication. It is possible to initiate the...