CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite (v1.3.1) has a stored XSS in the analytics collection endpoint (/collect). An unauthenticated user can supply crafted hostname and pathname to inject a javascript: URI, since parseHostname/parsePathname perform no URI scheme validation. The payload is stored and later rendered as an a...

CVE-2026-15612

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15612

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612 LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612

The Logto identity platform contains an OIDC nonce validation bypass (CVE-2026-15612) within its core protocol handling. The vulnerability occurs because the system stores a nonce in the connector session but only performs a validation check if the nonce claim is present in the id_token. When an ...

EUVD-2026-48304

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612 LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614

The Logto identity and access management system is vulnerable to an authentication bypass via session replay because it fails to atomically handle IdP-initiated SAML sessions . The root cause is that session lookup and session deletion are separate steps; because the lookup response is returned b...

EUVD-2026-48303

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

Not Failing Securely ('Failing Open')

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the auth process. An attacker can gain unauthorized access to protected resources by triggering a server-side configuration error that causes the auth...

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

SummaryIn affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...