BIT-AUTHENTIK-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

PT-2026-79842

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME LINK or EMAIL LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

EUVD-2026-61062

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

CVE-2026-57580 authentik: Account Takeover via SAML NameID Comment Truncation

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAMELINK or EMAILLINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion. An attacker with an...

JetBrains Upsource Information Disclosure Vulnerability

JetBrains Upsource is a set of code review tools from the Czech company JetBrains. A security vulnerability exists in JetBrains Upsource versions prior to 2020.1 that stems from an incorrect user matching algorithm. An attacker could exploit the vulnerability to obtain information...

CVE-2019-19704

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm...

CVE-2019-19704

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm...

Information disclosure

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm...

CVE-2019-19704

CVE-2019-19704 affects JetBrains Upsource prior to 2020.1, where an incorrect user matching algorithm could lead to information disclosure. The Red Hat/CNVD/NVD entries corroborate that Upsource before 2020.1 is vulnerable due to this issue. The Red Hat entry and CNVD descriptions consistently st...

CVE-2019-19704: Undefined Security Weakness

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm...

CVE-2016-9850

An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 ar...

CVE-2005-3139

Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set...

CVE-2005-3139

Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set...

CVE-2005-3139

Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set...

CVE-2005-3139

CVE-2005-3139 affects Bugzilla 2.19.1 through 2.20rc2 and 2.21. When user matching is enabled in substring mode, it can disclose usernames that match an arbitrary substring, even with useVisibilityGroups set. Root cause is substring-based user search bypassing visibility controls, leading to part...

CVE-2005-3139: Undefined Security Weakness

Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when the usevisibilitygroups parameter is set...