CVE-2026-61640 Wallos: SSRF via OIDC Token/UserInfo URL Configuration

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC tokenurl and userinfourl in includes/oidc/handleoidccallback.php:18-49 are used directly in curlinit with zero SSRF filtering. Unlike logo/webhook URLs which have...

PT-2026-83993

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.6 Description An issue exists where administrator-configured OpenID Connect OIDC token url and user info url variables within the handle oidc callback.php file are used directly in the curl init function without...

CVE-2026-82462

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

CVE-2026-82462

pac4j-oidc versions prior to 6.5.6 contain an authentication bypass vulnerability in the OIDC callback handling. The OidcCredentialsExtractor accepts callbacks carrying only an access token without requiring an authorization code or ID token, allowing attackers to substitute access tokens minted ...

EUVD-2026-68119

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...

CVE-2026-55076

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked emailverified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean for example the string...

Incorrect Type Conversion or Cast

Overview Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast via the OIDC callback process. An attacker can gain unauthorized access to user accounts by exploiting improper type handling of the emailverified claim, allowing account takeover without prior...

CVE-2026-44501

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend datahub-frontend-react deserializes attacker-controlled Java objects from the REDIRECTURL HTTP cookie during the OIDC callback flow, with no integrity protection no HMAC, no encryption. This is a Deserialization o...