PT-2026-105912

Impact The partial-pipeline resume mechanism accepted partial token as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and...

PT-2026-105913

Impact The LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victi...

PT-2026-105909

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the auth key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such ...

PT-2026-105911

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-core (1.1.0.release) +310 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.3.release)

org.springframework:spring-expression MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-core (1.1.4.release) +434 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.1.8.release)

org.springframework:spring-context MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

io.cronapp:cronapp-framework-java (>=2.9.4-sp.15, <=3.2.1-sp.30), io.cronapp:cronapp-plugin-elastic (>=3.1.0, <=3.2.1-sp.30) +9 more potentially affected by CVE-2025-22228 via org.springframework.security:spring-security-crypto (3.1.4.release)

org.springframework.security:spring-security-crypto MAVEN version 3.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-crypto and may be impacted: - io.cronapp:cronapp-framework-java =2.9.4-sp.15,...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-core (1.1.4.release) +236 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (4.1.8.release)

org.springframework:spring-web MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release - at.molindo.social:spring-social-core...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-core (1.1.4.release) +236 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (4.1.8.release)

org.springframework:spring-web MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release - at.molindo.social:spring-social-core...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-core (1.1.4.release) +431 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.1.8.release)

org.springframework:spring-expression MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

at.molindo.social:spring-social-openid (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +72 more potentially affected by CVE-2015-5258 via org.springframework.social:spring-social-core (>=1.0.0.release, <=1.1.2.release)

org.springframework.social:spring-social-core MAVEN version =1.0.0.release, =0.0.2, =1.31.1, =1.19.2, =0.0.1, =1.0.1, =1.0.0, =1.0, =1.6-release and more Source cves: CVE-2015-5258 Source advisory: OSV:GHSA-W5R6-GX3Q-HMXJ...

at.molindo.social:spring-social-openid (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +72 more potentially affected by CVE-2015-5258 via org.springframework.social:spring-social-core (>=1.0.0.release, <=1.1.2.release)

org.springframework.social:spring-social-core MAVEN version =1.0.0.release, =0.0.2, =1.31.1, =1.19.2, =0.0.1, =1.0.1, =1.0.0, =1.0, =1.6-release and more Source cves: CVE-2015-5258 Source advisory: GHSA-W5R6-GX3Q-HMXJ...

at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-core (1.1.0.release) +339 more potentially affected by CVE-2022-22970 via org.springframework:spring-beans (4.0.3.release)

org.springframework:spring-beans MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-beans and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...

at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-core (1.1.0.release) +310 more potentially affected by CVE-2022-22950 via org.springframework:spring-expression (4.0.3.release)

org.springframework:spring-expression MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...

at.molindo.social:spring-social-openid (1.1.0.release), cn.jhc:spring-social-qq (>=0.0.2, <=0.0.5) +72 more potentially affected by CVE-2015-5258 via org.springframework.social:spring-social-core (>=1.0.0.release, <=1.1.2.release)

org.springframework.social:spring-social-core MAVEN version =1.0.0.release, =0.0.2, =1.31.1, =1.19.2, =0.0.1, =1.0.1, =1.0.0, =1.0, =1.6-release and more Source cves: CVE-2015-5258 Source advisory: MEND:CVE-2015-5258...

Pivotal Software Spring Social Core Cross-Site Request Forgery Vulnerability

Pivotal Software Spring Social Core is a set of APIs for connecting social services from Pivotal Software, USA. A cross-site request forgery vulnerability exists in Pivotal Software Spring Social Core versions 1.0.0 to 1.0.3 and 1.1.0 to 1.1.2, which stems from the program failing to properly...