CVE-2026-57817 Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...

PT-2026-36107

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.9 Description The SAML IdP implementation in the SSO module uses the AssertionConsumerServiceURL value from incoming SAML AuthnRequest messages as the destination for the SAML response without validating it agains...

EUVD-2020-0265

Malware in sbrugna...

PT-2024-16931 · Mattermost · Mattermost Android Mobile Apps

Name of the Vulnerable Software and Affected Versions: Mattermost Android Mobile Apps versions =2.21.0 Description: The issue arises from a misconfiguration of file providers in the Mattermost Android Mobile Apps, allowing an attacker with local access to access files via the file provider. This...

Mail.ru: Database read through provider misconfiguration

Content provider implementation in ICQ for Android allowed another local application to force ICQ private files to be copied to insecure location...

UBUNTU-CVE-2017-12873

SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...