The vulnerability of the implementations of CAS, SAML, and OpenID Connect protocols in the web application for deploying distributed social networks like Mastodon allows attackers to circumvent security restrictions and gain access to user accounts.

The vulnerability of the implementation of CAS, SAML, and OpenID Connect protocols in the web application for deploying distributed social networks like Mastodon is related to deficiencies in the authentication process due to changes in the email address during login to the system. Exploiting thi...

The vulnerability of the authentication and authorization module for the Apache 2.x HTTP server Mod_auth_openidc, related to uncontrolled resource consumption, allows attackers to cause service interruptions.

The vulnerability of the authentication and authorization module for the Apache 2.x HTTP server, Modauthopenidc, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Red Hat JBoss Enterprise Application Platform 数据伪造问题漏洞

Red Hat JBoss Enterprise Application Platform EAP is an open source, J2EE-based middleware platform from Red Hat, Inc. The platform is primarily used to build, deploy and host Java applications and services. A data forgery vulnerability exists in Red Hat JBoss Enterprise Application Platform EAP,...

CVE-2024-31209

oidcc is the OpenID Connect client library for Erlang. Denial of Service DoS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. This issue has been patched in versions3.1.2 & 3.2.0-beta.3...

CVE-2024-31209 OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

oidcc is the OpenID Connect client library for Erlang. Denial of Service DoS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. This issue has been patched in versions3.1.2 & 3.2.0-beta.3...

CVE-2024-31209 OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

oidcc is the OpenID Connect client library for Erlang. Denial of Service DoS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. This issue has been patched in versions3.1.2 & 3.2.0-beta.3...

CVE-2024-31209

CVE-2024-31209 affects the Erlang OpenID Connect client library, oidcc. The vulnerability is a Denial of Service caused by atom exhaustion in the provider configuration worker when calling pinpointed functions: oidcc_provider_configuration_worker:get_provider_configuration/1 and oidcc_provider_co...

CVE-2024-31209 OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

oidcc is the OpenID Connect client library for Erlang. Denial of Service DoS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. This issue has been patched in versions3.1.2 & 3.2.0-beta.3...

oidcc 安全漏洞

oidcc is an open source OpenId Connect client library in Erlang & Elixir by The Erlang Ecosystem Foundation. A security vulnerability exists in oidcc 3.0.0 and later, which stems from the presence of a Denial of Service DoS vulnerability...

GHSA-MJ35-2RGF-CV8P OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

Impact DOS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited. Details Example to...

OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

Impact DOS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited. Details Example to...

Authentication Bypass

causal/oidc is vulnerable to Authentication Bypass. The vulnerability is due to improper verification of the OpenID Connect authentication state from the user lookup chain, leading to authentication of any valid frontend user with a non-empty "txoidc" field...

OpenID <= 3.6.1 - Reflected Cross-Site Scripting

Description The OpenID plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

GHSA-HHF8-F5W9-G6VH OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass

The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “txoidc” is not empty. In scenarios...

OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass

The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “txoidc” is not empty. In scenarios...

TYPO3-EXT-SA-2024-002: Authentication Bypass in "OpenID Connect Authentication" (oidc)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2024-002...

PT-2024-23225 · Typo3 · Openid Connect Authentication Extension For Typo3

Name of the Vulnerable Software and Affected Versions: OpenID Connect Authentication extension for TYPO3 affected versions not specified Description: The issue concerns a security bypass in the authentication service of the OpenID Connect Authentication extension for TYPO3. The authentication...

CVE-2024-31107

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1...

CVE-2024-31107 WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1...

CVE-2024-31107 WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1...