CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

CVE-2026-19625

CVE-2026-19625 is a cross-tenant authentication bypass in the OIDC extension of IBM Enterprise Build of Quarkus . When an optional token-introspection cache is enabled, a valid token issued by one OIDC provider tenant can be used to access endpoints secured by a different tenant, because the shar...

tanstack-shield

🛡️ tanstack-shield Escáner de ataques a la cadena de suministro con un solo comando para CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx Detecta el gusano "Mini Shai-Hulud" que comprometió 42 paquetes npm @tanstack/ 84 versiones maliciosas el 11 de mayo de 2026. root@kitploit: One line — scan your project...

...[ More ]

This Metasploit module exploits CVE-2026-48558 to forge an OpenID Connect identity token and obtain a SimpleHelp technician session. It then uses SimpleHelps legitimate remote access WebSocket protocol to connect to an online managed machine and execute a payload through the remote terminal. An...

GHSA-V2WP-FRMC-5Q3V

creationtimestamp| type| source ---|---|--- 2026-08-19 07:31:59+00:00| seen| https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad...

EUVD-2026-58810

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...

CVE-2026-73683 Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...

PT-2026-72122

Name of the Vulnerable Software and Affected Versions Laravel Socialite affected versions not specified Description The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in...

CVE-2026-19278 Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...

CVE-2026-9791 Keycloak-rhel9: organization data leak after feature disabled in keycloak

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect OIDC token with the 'organization' scope. This allows organization metadata to be disclosed in...

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Description OidcTokenHandler is Symfony's built-in access-token handler for OpenID Connect: it validates a bearer JWT and returns the authenticated user identity. It delegates claim validation to the web-token/jwt-checker library's ClaimCheckerManager. OidcTokenHandler::verifyClaims registers...

CVE-2026-45321

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself...

Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter

TanStack Supply Chain Compromise - IOC Checker bash curl -...

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow...

CVE-2026-45321

CVE-2026-45321 is a real npm supply-chain attack affecting 42 TanStack packages where 84 malicious releases were published within ~6 minutes using a legitimate GitHub Actions OIDC trusted-publisher binding. The malicious router_init.js payload exfiltrated credentials (GitHub tokens, cloud keys, S...

CVE-2026-45321

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/ packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself...

PT-2026-39905

Name of the Vulnerable Software and Affected Versions @tanstack/ packages affected versions not specified Description An attacker published 84 malicious versions across 42 @tanstack/ packages to the npm registry. The attack was executed by chaining three vulnerability classes: a pull request targ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...