CVE-2026-101574

A vulnerability exists in the OIDC component of the Helidon product within Oracle Fusion Middleware (affected versions 4.0.0-4.5.5 and 27.0.0 ). An unauthenticated attacker with network access via HTTP can exploit this high-complexity vulnerability, which requires human interaction , to compromis...

CVE-2026-108062

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-107597

The PIA software is vulnerable to Server-Side Request Forgery (SSRF) due to improper validation of the jwks_uri in OIDC discovery documents. Specifically, the verify_token function in pia/oidc.py follows the jwks_uri without verifying its origin, scheme, or requiring HTTPS, only checking that the...

CVE-2026-107597 jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

PIA's token verification verifytoken in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwksuri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the...

CVE-2026-107597 jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

PIA's token verification verifytoken in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwksuri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the...

EUVD-2026-104908

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

CVE-2026-108062

The CVE-2026-108062 vulnerability involves pre-authentication OIDC discovery and JWKS fetches running synchronously on the asyncio event loop . This synchronous execution causes a single unauthenticated request to stall the entire service, leading to a CWE-400 Uncontrolled Resource Consumption is...

CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

PT-2026-118322

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

PT-2026-119254

Vulnerability in the Helidon product of Oracle Fusion Middleware component: OIDC. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require huma...

PT-2026-118321

PIA's token verification verify token in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that th...

Malware in @an1mshnpmb9c84920/oidc-cross-cafb9d929e

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

GO-2026-6758 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api

Vikunja: OIDC email-fallback account linking ignores emailverified, enabling local-account takeover in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positi...

CVE-2026-111882

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

CVE-2025-71435

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2025-71435

Versions of Coder prior to 2.23.0 are vulnerable to a session expiration bypass when using OIDC without a refresh token. Authenticated users can maintain access after their OIDC token expires by keeping their APIKey cookie active through regular use, which extends the session indefinitely every 2...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

EUVD-2025-211113

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...