PT-2026-48659

A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cookie Handler. Executing a manipulation can lead to sensitive cookie without secure attribute. The attack can be launched remotely. This attac...

Gatus security vulnerabilities

Gatus is a service health monitoring and alerting tool developed by TwiN’s individual developers. Version 5.36.0 of Gatus contains a security vulnerability. This vulnerability stems from the setSessionCookie function in the OIDC session cookie handler. Performing certain operations may result in...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute due to the lack of the Secure attribute on session and OIDC state cookies in the authentication process. An attacker can recover session cookies and impersonate a user or enab...

GHSA-G759-4PXW-6692 @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers

Affected: @hulumi/policies 1.4.0 — Fixed in: 1.4.0 — Severity: High — CWE-697 Incorrect Comparison Summary AWS IAM trust policies can list more than one federated identity provider — for example, a role that accepts BOTH GitHub Actions OIDC and Google's OIDC. The GOIDC1 and GOIDC2 policy rules ar...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

com.keyholesoftware:khs-sherpa-spring (>=1.2.0, <=1.2.1), org.codehaus.spring-security-oauth:spring-security-oauth (>=3.9.ss3, <=3.11.ss3) +9 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.0.release)

org.springframework.security:spring-security-web MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.keyholesoftware:khs-sherpa-spring =1.2.0, =3.9.ss3,...

com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.springframework.security:spring-security-cas (4.2.16.release) +3 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.16.release)

org.springframework.security:spring-security-web MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sdl.delivery:udp-service-container-core...

org.springframework.security:spring-security-cas (4.2.14.release), org.springframework.security:spring-security-openid (4.2.14.release) +2 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.2.14.release)

org.springframework.security:spring-security-web MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), com.erudika:para-server (1.13) +16 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (4.0.0.release)

org.springframework.security:spring-security-web MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =2.5.2, =3.3.0...

org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4), org.springframework.security:spring-security-cas (3.2.2.release) +3 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.2.2.release)

org.springframework.security:spring-security-web MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.pac4j:spring-security-pac4j =1.2.3, =1.2.4 -...

com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta), com.logitags:cibet (>=1.1, <=1.9) +17 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.0.3.release)

org.springframework.security:spring-security-web MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.force.sdk:force-springsecurity =22.0.2-beta, =1.1,...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

org.springframework.security:spring-security-cas (4.2.14.release), org.springframework.security:spring-security-openid (4.2.14.release) +2 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.14.release)

org.springframework.security:spring-security-web MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.springframework.security:spring-security-cas (4.2.16.release) +3 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.2.16.release)

org.springframework.security:spring-security-web MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sdl.delivery:udp-service-container-core...

ba.jamax.util:jamax-rest (>=1.3.1-release, <=1.3.4-release), com.erudika:para-server (1.13) +16 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (4.0.0.release)

org.springframework.security:spring-security-web MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - ba.jamax.util:jamax-rest =1.3.1-release, =2.5.2, =3.3.0...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-cas (3.1.6.release) +5 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.1.6.release)

org.springframework.security:spring-security-web MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4.9,...

org.pac4j:spring-security-pac4j (>=1.2.3, <=1.2.4), org.springframework.security:spring-security-cas (3.2.2.release) +3 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.2.2.release)

org.springframework.security:spring-security-web MAVEN version 3.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.pac4j:spring-security-pac4j =1.2.3, =1.2.4 -...

org.springframework.security:spring-security-cas (3.1.5.release), org.springframework.security:spring-security-openid (3.1.5.release) +1 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.1.5.release)

org.springframework.security:spring-security-web MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

EUVD-2026-35860

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product...

PT-2026-48474

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.4.0 Description IAM-role policy checks can be bypassed when a role trusts multiple OIDC OpenID Connect providers. The issue occurs when the Principal.Federated field contains a JSON array of multiple...