EUVD-2026-90769

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

PT-2026-56817

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0 Description Instances configured with multiple trusted token-exchange issuers resolve external identities to local accounts using only the sub claim of the JSON Web Token JWT and...

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Summary Centrifugo's dynamic JWKS endpoint feature can verify a JWT for one allowed issuer using a public key cached from another allowed issuer. The JWKS cache and singleflight lookup are keyed only by the JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or other trust-domain...