CVE-2026-104046

A flaw exists in SSSD (System Security Services Daemon) where Identity Provider (IdP) authentication requests retain state in memory without proper clearing or timeouts. A local attacker can exploit this by repeatedly initiating authentication flows without completing them, leading to unbounded m...

CVE-2026-104046 Sssd: sssd: denial of service via incomplete identity provider authentication requests

A flaw was found in SSSD System Security Services Daemon. When Identity Provider IdP authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing...

CVE-2026-47158

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact...

CVE-2024-1900

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

CVE-2024-1900: Insufficient Session Expiration

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...