67201 matches found
CVE-2026-55735
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...
EUVD-2026-51914
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...
CVE-2026-55735
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...
CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...
EEF-CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Summary Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only...
CVE-2026-55735
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...
CVE-2026-55735
CVE-2026-55735 affects guardian: from 1.0.0 up to before 2.4.1. The revoke/3 path in Guardian.revoke/3 decodes tokens with peek/1 without signature verification, unlike refresh/2 and exchange/4 which verify. An attacker who knows a victim’s jti/sub can forge a JWT and submit it to an endpoint tha...
CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...
CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation
Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...
Predictable WebSocket Session IDs
org.springframework, spring-websocket is vulnerable to Predictable WebSocket Session IDs. The vulnerability is due to WebSocket session IDs in the spring-websocket module not being cryptographically unpredictable, which allows an attacker to potentially predict valid session IDs and gain...
Cross-site Scripting (XSS)
Overview @better-auth/sso is a SSO plugin for Better Auth Affected versions of this package are vulnerable to Cross-site Scripting XSS through the SAML login pipeline in packages/sso/src/routes/saml-pipeline.ts. An attacker can sign in as another user by sending a SAML response whose...
Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wm3w-8rrp-j577. This link is maintained to preserve external references. Original Description guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the...
CVE-2026-67355
guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intended only for parent hosts, potentially disclosing session...
CVE-2026-67337
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...
CVE-2025-71402
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...
CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...
CVE-2026-67337
CVE-2026-67337 affects better-auth versions before 1.4.9. The issue is a two‑factor authentication bypass when session.cookieCache is enabled: attackers with valid primary credentials can reach authenticated routes without completing second‑factor verification by exploiting premature session cach...
EUVD-2026-51837
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...
CVE-2026-67333 better-auth before 1.6.13 Stored XSS via javascript redirect_uri
better-auth before 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fail to validate the scheme of redirecturis registered via the deprecated oidc-provider plugin and the mcp plugin which wraps the same provider. An attacker can register an OAuth client with a javascript:...
CVE-2026-67334
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...