kratos

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Kratos is an API first identity and user management system for cloud native applications. It centralizes login, registration, recovery, verification, and profile management flows so your services consume them instead of...

dex

dex - Un proveedor OpenID Connect federado Dex es un servicio de identidad que utiliza OpenID Connectopenid-connect para impulsar la autenticación de otras aplicaciones. Dex actúa como un portal hacia otros proveedores de identidad a través de "conectores". Esto permite que dex delegue la...

kratos

聊天 · 讨论 · 新闻邮件 · 文档 · 试用Ory Network · 工作机会 Ory Kratos 是一个面向云原生应用的 API 优先身份与用户管理系统。它将登录、注册、恢复、验证和配置文件管理流程集中起来，让你的服务可以直接使用它们，而无需重新实现。 目录 什么是 Ory Kratos？ 为什么选择 Ory Kratos 从 Auth0、Okta 及类似提供商迁移 部署选项 在 Ory Network 上使用 Ory Kratos 自托管 Ory Kratos 快速开始 谁在使用它？ 什么是 Ory Kratos？ Ory Kratos 是一个遵循 云架构最佳实践 的 API...

boundary

Boundary What is Boundary: https://developer.hashicorp.com/boundary/docs/what-is-boundary Website: https://www.developer.hashicorp.com/boundary/ Forums: HashiCorp Discuss Documentation: https://developer.hashicorp.com/boundary/docs Tutorials: HashiCorp's Learn Platform Boundary is an identity-awa...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — front OIDC session hijacking Front estático que ejecuta el flujo OIDC authorization code contra un Keycloak y expone el hook de secuestro de sessionid del PoC. Se sirve con nginx en el puerto 5174 para uso del equipo. Levantarlo en la VPS cd vps/pocCVE0264 docker compose up -d...

FlowAnalyzer

Flow Analyzer Flow Analyzer está diseñado para ayudar en la comprensión de bajo nivel y en las pruebas de los Grants/Flows de OAuth 2.0. Aunque mis casos de uso provienen del lado de la seguridad, también puede ser beneficioso desde el punto de vista de un ingeniero 😊 Encontrarás los notebooks pa...

org.apache.cxf/cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

CVE-2026-65583

A flaw was found in Apache CXF. The OpenID Connect OIDC relying-party token validation in Apache CXF could accept specially crafted self-issued ID tokens. This bypasses necessary claim checks, such as issuer, subject, audience, and time, leading to an authentication bypass. This vulnerability...

CVE-2026-82843

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

EUVD-2026-85030

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

Important: Red Hat Security Advisory: mod_auth_openidc security update

An update for modauthopenidc is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

The vulnerability of the Authlib OAuth 2.0 library server against OAuth and OpenID Connect servers allows a hacker to redirect a user to any given URL address.

The vulnerability of the Authlib OAuth 2.0 library server for OAuth and OpenID Connect servers involves redirecting the URL to an unreliable website. Exploiting this vulnerability could allow a malicious actor to redirect users to any given URL address...

CVE-2026-78428: Session Fixation

For users authenticated through SAML or OpenID Connect OIDC, this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently...

warpgate v0.29.0-beta.1

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper. Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network. Warpgate will record ever...

Important: mod_auth_openidc

Issue Overview: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to JwtRequestCodeFilter copying security-sensitive claims from a signed request JWT into the authorization parameter map without proper validation, which allows an attacker with a validly signed JWT to replace...

GHSA-PF83-W3F9-8M37 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The pat...

CVE-2026-55221

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...