CVE-2026-73535

A flaw was found in Gitea. When OpenID Connect sign-in is enabled, the authentication handler verifies a user's password but fails to enforce enrolled second-factor authentication, such as a Time-based One-Time Password TOTP or security key. A remote attacker with knowledge of a victim's password...

boundary

Boundary Community Edition CE is no longer under active development, and this repository has been archived as of October 8, 2026. Future Boundary development will focus on HCP Boundary and Boundary Enterprise, where we can provide enterprise grade human and agentic access capabilities. This...

dex

dex - A federated OpenID Connect provider Dex is an identity service that uses OpenID Connectopenid-connect to drive authentication for other apps. Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or...

hydra

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. It connects to your existing identity provider through a login and conse...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — frontend OIDC session hijacking Static frontend that runs the OIDC flow authorization code against a Keycloak and exposes the sessionid hijacking hook of the PoC. It is served with nginx on port 5174 for team use. Launching it on the VPS cd vps/pocCVE0264 docker compose up -d...

FlowAnalyzer

Flow Analyzer Flow Analyzer is designed for helping in low level understanding and testing of OAuth 2.0 Grants/Flows. Although my use cases are from the security side of things, it can be beneficial from an engineer's point of view as well 😊 You'll find the notebooks to execute the flows under th...

CVE-2026-102893

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's deliveryemail without rejecting an explicitly false emailverified claim. If a configured identity provider returns a...

CVE-2026-102893 Zulip: OpenID Connect authentication ignores the email_verified claim

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's deliveryemail without rejecting an explicitly false emailverified claim. If a configured identity provider returns a...

CVE-2026-102893 Zulip: OpenID Connect authentication ignores the email_verified claim

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's deliveryemail without rejecting an explicitly false emailverified claim. If a configured identity provider returns a...

CVE-2026-102893

In Zulip Server versions through 12.1 , a vulnerability exists in the GenericOpenIdConnectBackend component. The system fails to reject an explicitly false email_verified claim when matching an identity provider's email claim to an active account's delivery_email . This allows an attacker to log ...

CVE-2026-73535

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

CVE-2026-73535 Gitea second-factor bypass through OpenID identity linking

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

CVE-2026-73535

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

CVE-2026-73535

The Gitea OpenID connect handler contains a flaw where it accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. If OpenID sign-in is enabled, an attacker who possesses the victim's password can obtain a sessi...

CVE-2026-73535

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

CVE-2026-73535 Gitea second-factor bypass through OpenID identity linking

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

EUVD-2026-101104

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...

Keycloak OpenID Connect DoS

The vulnerability of the Keycloak identity management and access control software is related to the handling of abnormally long scope parameters in the OpenID Connect mechanism. Exploiting this vulnerability could allow a malicious actor to trigger service failures...

CVE-2026-73535: Missing Critical Step in Authentication

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an...