CVE-2026-80428

ILIAS (e-learning platform) is vulnerable to unauthenticated PHP object injection via its Shibboleth back-channel endpoint (shib_logout.php). The endpoint's logout-notification handler deserialises all live session rows without restricting constructable classes, and runs in a context exempt from ...

CVE-2026-80428 ILIAS before 9.22, 10.10 and 11.3 Unauthenticated PHP Object Injection via Shibboleth Logout Endpoint

ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shiblogout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to...

CVE-2026-80428 ILIAS before 9.22, 10.10 and 11.3 Unauthenticated PHP Object Injection via Shibboleth Logout Endpoint

ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shiblogout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to...

The vulnerability of the Moodle learning management system allows a perpetrator to bypass the authentication process for arbitrary users.

The vulnerability of the auth/shibboleth/logout.php component of the Moodle learning management system is related to the。 Exploiting this vulnerability could allow a malicious actor, operating remotely, to bypass authentication procedures for arbitrary users using specially crafted requests...