CVE-2022-23610

CVE-2022-23610 affects wire-server before 2022-01-27, where an upstream library used for parsing/validating SAML XML could accept attacker-provided public keys as trusted in signatures. This enabled an attacker to bypass SAML SSO and impersonate any Wire user with SAML credentials, including crea...

CVE-2021-41119

CVE-2021-41119 affects Wire-server (back-end service). A denial-of-service vulnerability exists in pre-2022-03-01 releases where a crafted JSON object can trigger a hash collision, causing the parser to run in at least quadratic time and potentially exhaust server resources on heavily loaded inst...

CVE-2021-41100

CVE-2021-41100 affects Wire-server (Wire’s backing server). A short-lived session token in the Authorization header can be used to change a user’s email, which may enable account takeover due to subsequent password changes. Public details indicate that Version 2021-08-16 and later added a new end...