CVE-2026-106488

A flaw was found in plugin-auth-backend-module-oidc-provider. In deployments using email-based identity resolution with an OpenID Connect OIDC provider that allows unverified email addresses, an authenticated attacker can achieve privilege escalation by assuming another catalog identity. This...