kratos

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Kratos is an API first identity and user management system for cloud native applications. It centralizes login, registration, recovery, verification, and profile management flows so your services consume them instead of...

EUVD-2026-116105

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies...

CVE-2026-38601

The codeskyblue gohttpserver (through version v1.3.0 ) contains a hardcoded session secret key . This vulnerability allows an attacker to forge session cookies, leading to the ability to impersonate any user , bypass OpenID Connect authentication , and gain access to all controls. No specific rem...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

dex

dex - A federated OpenID Connect provider Dex is an identity service that uses OpenID Connectopenid-connect to drive authentication for other apps. Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or...

boundary

Boundary Community Edition CE is no longer under active development, and this repository has been archived as of October 8, 2026. Future Boundary development will focus on HCP Boundary and Boundary Enterprise, where we can provide enterprise grade human and agentic access capabilities. This...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — frontend OIDC session hijacking Static frontend that runs the OIDC flow authorization code against a Keycloak and exposes the sessionid hijacking hook of the PoC. It is served with nginx on port 5174 for team use. Launching it on the VPS cd vps/pocCVE0264 docker compose up -d...

FlowAnalyzer

Flow Analyzer Flow Analyzer is designed for helping in low level understanding and testing of OAuth 2.0 Grants/Flows. Although my use cases are from the security side of things, it can be beneficial from an engineer's point of view as well 😊 You'll find the notebooks to execute the flows under th...

EUVD-2026-111112

Authlib RFC 7592 examples omit registration-access-token client binding...

CVE-2026-71575

A flaw was found in Apache CXF. The authentication freshness verification mechanism in the OpenID Connect OIDC client filter fails to properly evaluate session age due to a unit mismatch and flawed comparison logic. A remote attacker with a stale or expired session can exploit this issue to bypas...

CVE-2026-118554

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2026-114542 Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth OAuth2 & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth OAuth2 & OpenID Connect versions: from 6.1.0 to 6.1.3...

CVE-2026-114542

The Drupal Simple OAuth (OAuth2) & OpenID Connect module (versions 6.1.0 to 6.1.3 ) is vulnerable to an access bypass due to a Use of Web Browser Cache Containing Sensitive Information (CWE-525). The module incorrectly caches token permissions, allowing them to be reused for other user tokens wit...

CVE-2026-114542 Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth OAuth2 & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth OAuth2 & OpenID Connect versions: from 6.1.0 to 6.1.3...

CVE-2026-118572

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1...

CVE-2026-118554 OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2026-118554

The Drupal OpenID Connect Client module (versions 0.0.0 to 2.3.1 ) contains an authentication bypass vulnerability. The root cause is that the module attempts to link a new user logging in via OpenID Connect (oAuth2) to an existing account sharing the same email address. This allows an attacker t...

CVE-2026-118554

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2026-118554 OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

EUVD-2026-113687

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...