CVE-2026-92773: Authorization Bypass Through User-Controlled Key

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

GO-2026-5635 nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh

nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute due to the lack of the Secure attribute on session and OIDC state cookies in the authentication process. An attacker can recover session cookies and impersonate a user or enab...

mod_auth_openidc security update

2.4.10-1 Rebase to 2.4.10 version improves state cookies piling up problem Resolves: RHEL-32450 Race condition in modauthopenidc filecache Resolves: RHEL-25422 modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating cookies CVE-2024-24814...