kratos

チャット · ディスカッション · ニュースレター · ドキュメント · Ory Networkを試す · 採用情報 Ory Kratosは、クラウドネイティブアプリケーション向けのAPIファーストなID・ユーザー管理システムです。ログイン、登録、復旧、確認、プロフィール管理のフローを一元化し、あなたのサービスがそれらを再実装する代わりに利用できるようにします。 目次 Ory Kratosとは？ なぜOry Kratosなのか Auth0、Okta、類似プロバイダーからの移行 デプロイオプション Ory NetworkでOry Kratosを使用する Ory Kratosをセルフホストす...

hydra

聊天 · 讨论 · 新闻通讯 · 文档 · 试用 Ory Network · 职位 Ory Hydra 是一个经过加固、通过 OpenID 认证的 OAuth 2.0 服务器和 OpenID Connect 提供程序，针对低延迟、高吞吐量和低资源 消耗进行了优化。它通过登录和 同意应用连接到您现有的身份提供商，让您对用户界面和体验拥有绝对控制权。 什么是 Ory Hydra？ 为什么选择 Ory Hydra OAuth2 和 OpenID Connect：开放标准 OpenID Connect 认证 部署选项 在 Ory Network 上使用 Ory Hydra 自托管 Ory Hyd...

dex

dex - 一个联邦式 OpenID Connect 身份提供者 Dex 是一种身份服务，使用 OpenID Connect 为其他应用驱动身份认证。 Dex 通过连接器.充当通往其他身份提供者的门户。这使 dex 可以将身份认证委托给 LDAP 服务器、SAML 提供商，或 GitHub、Google 和 Active Directory 等成熟的身份提供者。客户端只需编写一次与 dex 通信的身份认证逻辑，随后由 dex 处理特定后端的协议。 ID Tokens ID Token 是 OpenID Connect 引入的一种 OAuth2 扩展，也是 dex 的主要功能。ID Tok...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — 前端（OIDC 会话劫持） 静态前端，针对 Keycloak 执行 OIDC（授权码）流程，并暴露 PoC 的 sessionid 劫持钩子。通过 nginx 在 5174 端口提供服务，供团队使用。 启动（在 VPS 上） root@kitploit: cd vps/pocCVE0264 docker compose up -d --build 它位于 http://maquina:5174。请在云服务商防火墙中开放 5174/TCP （就像你对 8443 所做的那样）。 Keycloak URL 通过环境变量注入（未硬编码在 HTML 中）：在...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

CVE-2026-82462 pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification...

FlowAnalyzer

Flow Analyzer Flow Analyzer è progettato per aiutare nella comprensione di basso livello e nel test dei Grant/Flows di OAuth 2.0. Anche se i miei casi d'uso provengono dal lato della sicurezza, può essere utile anche dal punto di vista di un ingegnere 😊 Troverai i notebook per eseguire i flussi...

boundary

Boundary Cos'è Boundary: https://developer.hashicorp.com/boundary/docs/what-is-boundary Sito web: https://www.developer.hashicorp.com/boundary/ Forum: HashiCorp Discuss Documentazione: https://developer.hashicorp.com/boundary/docs Tutorial: Piattaforma Learn di HashiCorp Boundary è un proxy...

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication...

CVE-2026-63687

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

Linux Distros Unpatched Vulnerability : CVE-2026-70665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client...

DEBIAN-CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect (a Rails OpenID Connect provider built on Doorkeeper) is vulnerable to scope privilege escalation prior to version 1.10.4 . The Dynamic Client Registration (DCR) endpoint (DynamicClientRegistrationController#application_params) assigns the scope parameter directly from p...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

EUVD-2026-36714

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching...

PT-2026-81890

Name of the Vulnerable Software and Affected Versions Doorkeeper OpenID Connect versions prior to 1.10.4 Description The Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. In the...

Astra Linux – Vulnerability in Ceph

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and earlier, it is possible to send a JWT with “none” as its JWT algorithm. By doing this, the JWT signature is not checked. The vulnerability lies most likely in the RadosGW OIDC provider. As of the time of...