gapps

Gapps Gapps is an Security compliance platform that makes it easy to track your progress against various security frameworks. ❄️ View the Gapps site 🏠 Interested in contacting me? Please join our discord Table of Contents 1. Getting Started 2. FAQ New Features ❄️ SOC2, NIST CSF, NIST-800-53, CMMC,...

fulcio

Fulcio A Free-to-Use CA For Code Signing Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity, such as email address. Fulcio only issues short-lived certificates that are valid for 10 minutes. Public Instance Fulcio is in General...

zitadel

The Identity Infrastructure for Developers ZITADEL...

pentest-mcp

Pentest MCP Professional penetration-testing MCP server with modern transport/auth support and expanded recon tooling. What Changed in 0.9.0 Upgraded MCP SDK to @modelcontextprotocol/sdk@^1.26.0 Kept MCP Inspector at the latest release @modelcontextprotocol/inspector@^0.20.0 with bundled launcher...

authentik

What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp = 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured. id: CVE-2026-48558 info: name:...

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

CVE-2026-114619

A flaw was found in Authlib. This vulnerability allows an authenticated client to bypass authorization scope restrictions and obtain an unauthorized OpenID Connect OIDC identity token, leading to information disclosure. During an implicit grant authorization request, the application evaluates the...

DEBIAN-CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

EUVD-2026-108513

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614

The Authlib Python library (versions 0.13 through 1.8.0 ) is vulnerable due to a flaw in authlib.common.security.is_secure_transport() . The function uses a textual prefix comparison for loopback HTTP exemptions, which can be exploited if a URL's userinfo component begins with a loopback host whi...

CVE-2026-115360

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

EUVD-2026-108285

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360

OpenBao versions before 2.6.3 are vulnerable to an open redirect vulnerability located in the UI's OIDC identity provider . This flaw impacts unauthenticated users , as attackers can craft malicious OIDC links to redirect them to attacker-controlled destinations, potentially facilitating phishing...

CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...