CVE-2026-91160 OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

PT-2026-98155

Name of the Vulnerable Software and Affected Versions OpenWA versions prior to 0.23.5 Description The /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through a wildcard subscription, bypassing the OPERATOR role requirement normally...

PT-2026-97895

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where the system fails to reject Write or Reply chunks that have a segcount field set to zero. Because the xdr check write chunk function only...

CVE-2026-55210

Joplin Server prior to 3.7.2 contains a vulnerability in UserModel.ssoLogin() where the method returns an existing account matched by an IdP-asserted email without checking the is_external flag . In deployments using mixed local and SAML authentication , an attacker whose IdP session can assert a...

CVE-2026-82842

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identit...

CVE-2026-88952 OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth2.UserResolver.resolve/3 matches an existing account using the register action...

GO-2026-6470 ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel

ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2026-92358

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

EUVD-2026-80173

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358

Keycloak 's first broker login flow contains a flaw where a temporary proof created during a cross-browser account-linking request is not properly cleared after the link is established or manually removed. An attacker who controls the external identity can exploit this residual proof to silently ...

CVE-2026-92358

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

PT-2026-93317

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-92358: Insufficient Session Expiration

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow in the elfx8664relocatesection function due to improper handling of the roff argument. An attacker can achieve unauthorized access to memory and potentially execute arbitrary code by supplying a specially crafted input...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking, violating the WebAuthn goals. This vulnerability affect...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Fork: Defer linking of vma until vma is fully initialized. Thorvald reported a WARNING 1. The root cause of the issue lies in a race condition: - CPU 1: fork; - fork: Calls hugetlbfsfallocate. - dupmmap: Calls hugetlbfspunchhole....

EUVD-2026-42966

ZITADEL: Auto-linking by email: IdP-side email verification is not checked...

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...

GHSA-992Q-9GWP-7R79 ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...