SUSE CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

CVE-2024-11217

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options...

CVE-2024-11217 Oauth-server-container: oauth-server-container logs client secret in debug level

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options...

CVE-2024-11217

CVE-2024-11217 affects the OAuth-server (including oauth-server-container). The vulnerability causes the OAuth2 client secret to be logged when the logLevel is set to Debug or higher for OIDC/GitHub/GitLab/Google IDP logins. Impact is exposure of OAuth2 client secrets via logs (confidentiality ri...

CVE-2024-11217 Oauth-server-container: oauth-server-container logs client secret in debug level

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options...

CVE-2024-52512 Nextcloud User OIDC has an open redirection when logging in with User OIDC

useroidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0...

CVE-2024-52512 Nextcloud User OIDC has an open redirection when logging in with User OIDC

useroidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0...

CVE-2024-52512

CVE-2024-52512 affects the Nextcloud User OIDC app (OpenID Connect backend). A malformed login link can trigger an open redirect to a user-supplied URL after successful authentication. The issue is documented across multiple sources (e.g., Red Hat, CVE lists, advisories) with typical impact descr...

CVE-2024-52512 Nextcloud User OIDC has an open redirection when logging in with User OIDC

useroidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0...

Open redirection when logging in with User OIDC

None...

CVE-2024-11217

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options...

CVE-2021-35473

An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4...

CVE-2021-35473

An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4...

CVE-2024-51746 Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

Security Bulletin: A Security Vulnerability was fixed in IBM Security Verify Access. (CVE-2024-35133)

Summary An issue found in the IBM Security Verify Access OIDC code could allow a remote attacker to cause a Redirect URL vulerability Vulnerability Details CVEID:CVE-2024-35133 DESCRIPTION: IBM Security Verify Access OIDC Provider could allow a remote attacker to conduct phishing attacks, using a...

Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

Impact IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens. Note that this only...

CVE-2024-8901

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

CVE-2024-8901 Lack of JWT issuer and signer validation

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

CVE-2024-8901 Lack of JWT issuer and signer validation

The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provides an OIDC authentication mechanism that was integrated into the open source Kubeflow project. The adapter uses JWT for authentication, but lacks proper signer...

CVE-2024-8901

CVE-2024-8901 concerns the AWS ALB Route Directive Adapter for Istio, which integrated OIDC-like JWT authentication into Kubeflow. The issue arises from missing signer and issuer validation for JWTs, allowing an attacker to spoof OIDC sessions by presenting a JWT signed by an untrusted entity. Th...