CVE-2026-15614

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15612 LOIDC nonce validation bypass

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

EUVD-2026-48304

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612

CVE-2026-15612 affects Logto Identity Platform. The vulnerability arises when the OIDC nonce validation is skipped if the id_token omits the nonce claim, because the validation path checks if data.nonce. As a result, a missing nonce can allow replay of authentication tokens and weaken session-bin...

CVE-2026-15614

CVE-2026-15614 affects Logto: IdP-initiated SAML sessions are not handled atomically, as session lookup may complete before deletion. This can allow the same session identifier to pass validation twice, enabling replay/dual sign-ins within the session’s window. The description and connected refer...

EUVD-2026-48303

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...

Not Failing Securely ('Failing Open')

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the auth process. An attacker can gain unauthorized access to protected resources by triggering a server-side configuration error that causes the auth...

PYSEC-2026-3482 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...

PYSEC-2026-3481 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...

PYSEC-2026-3510 PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI LinearBot processes unsigned webhooks when LINEARWEBHOOKSECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEARWEBHOOKSECRET as optional. When the secret is absent, startup only logs a warning and handlewebhook skips Linear-Signature...

EUVD-2026-48239

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session...

CVE-2026-64812

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

EUVD-2026-48237

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64813

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...

CVE-2026-64813

JetBrains IntelliJ IDEA prior to version 2026.2 contains a vulnerability where unauthorized settings modification is possible during Remote Development sessions. The issue is indicated as a CRITICAL impact (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with network attack vector, no privileges r...

EUVD-2026-48238

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Media Session component in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

PT-2026-63967

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists in Remote Development sessions that allows for the unauthorized modification of settings. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...