dex

dex - Un proveedor OpenID Connect federado Dex es un servicio de identidad que utiliza OpenID Connectopenid-connect para impulsar la autenticación de otras aplicaciones. Dex actúa como un portal hacia otros proveedores de identidad a través de "conectores". Esto permite que dex delegue la...

hydra

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Hydra is a hardened, OpenID Certified OAuth 2.0 Server and OpenID Connect Provider optimized for low-latency, high throughput, and low resource consumption. It connects to your existing identity provider through a login and conse...

kratos

Chat · Discusiones · Boletín informativo · Documentación · Probar Ory Network · Empleos Ory Kratos es un sistema de gestión de identidad y usuarios API-first para aplicaciones nativas de la nube. Centraliza los flujos de inicio de sesión, registro, recuperación, verificación y gestión de perfiles...

boundary

Boundary Qué es Boundary: https://developer.hashicorp.com/boundary/docs/what-is-boundary Sitio web: https://www.developer.hashicorp.com/boundary/ Foros: HashiCorp Discuss Documentación: https://developer.hashicorp.com/boundary/docs Tutoriales: Plataforma de aprendizaje de HashiCorp Boundary es un...

WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting

WordPress OpenID Connect Generic Client plugin 3.8.0 and 3.8.1 contains a cross-site scripting vulnerability. It does not sanitize the login error when output back in the login form, thereby not requiring authentication, which can be exploited with the default configuration. id: CVE-2021-24214...

Payara Micro Community 5.2021.6 Directory Traversal

Payara Micro Community 5.2021.6 and below contains a directory traversal vulnerability. id: CVE-2021-41381 info: name: Payara Micro Community 5.2021.6 Directory Traversal author: pikpikcu severity: high description: Payara Micro Community 5.2021.6 and below contains a directory traversal...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

oauth-scan

OAUTHScan Descripción OAUTHScan es una extensión de Burp Suite escrita en Java con el objetivo de proporcionar algunas comprobaciones de seguridad automáticas, que pueden ser útiles durante las pruebas de penetración en aplicaciones que implementan los estándares OAUTHv2 y OpenID. El plugin busca...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — frontend OIDC session hijacking Static frontend that runs the OIDC flow authorization code against a Keycloak and exposes the sessionid hijacking hook of the PoC. It is served with nginx on port 5174 for team use. Launching it on the VPS cd vps/pocCVE0264 docker compose up -d...

OAUTHScan

OAUTHScan Descripción OAUTHScan es una extensión de Burp Suite escrita en Java con el objetivo de proporcionar algunas comprobaciones automáticas de seguridad, que podrían ser útiles durante las pruebas de penetración en aplicaciones que implementan los estándares OAUTHv2 y OpenID. El plugin busc...

FlowAnalyzer

Flow Analyzer Flow Analyzer está diseñado para ayudar en la comprensión de bajo nivel y en las pruebas de los Grants/Flows de OAuth 2.0. Aunque mis casos de uso provienen del lado de la seguridad, también puede ser beneficioso desde el punto de vista de un ingeniero 😊 Encontrarás los notebooks pa...

cxf-rt-rs-security-oauth2: Apache CXF: Security bypass due to improper handling of authorization parameters

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

org.apache.cxf/cxf: Apache CXF: Authorization Code Substitution via missing c_hash validation

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...

CVE-2026-63203

In Logto versions 1.31.0 through 1.42.0 , a vulnerability exists in the Account API handlers located in packages/core/src/routes/account/third-party-tokens.ts. The root cause is that the handlers authenticate users but fail to require the identities scope , allowing callers with only an openid sc...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203: Missing Authorization

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-65583

A flaw was found in Apache CXF. The OpenID Connect OIDC relying-party token validation in Apache CXF could accept specially crafted self-issued ID tokens. This bypasses necessary claim checks, such as issuer, subject, audience, and time, leading to an authentication bypass. This vulnerability...

CVE-2026-82843

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...

EUVD-2026-85030

The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...