Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
237 results · page 3 of 5
Mar 5, 2025OpenDJ is an LDAPv3 compliant directory service.CVE-2025-27497 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.7
OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.
- Product
- OpenDJ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.CVE-2025-27675 · Other software · Printerlogic · reported by MITRECritical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.
- Product
- Vasion Print
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.printerlogic.compierrekim.github.io
Mar 3, 2025OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations.CVE-2025-27370 · Other software · OpenID · reported by MITREMedium 6.9
OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client.
- Product
- OpenID Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeprint.iacr.orggithub.com
Feb 18, 2025Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens.CVE-2025-26620 · Other software · DuendeSoftware · reported by GitHubMedium 6.3
Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other protocol parameters. Such usage is somewhat atypical, and only a small percentage of users are likely to be affected. Duende.AccessTokenManagement can request access tokens using the client credentials flow in several ways. In basic usage, the client credentials flow is configured once and the parameters do not vary. In more advanced situations, requests with varying protocol parameters may be made by calling specific overloads of these methods: `HttpContext.GetClientAccessTokenAsync()` and `IClientCredentialsTokenManagementService.GetAccessTokenAsync()`. There are overloads of both of these methods that accept a `TokenRequestParameters` object that customizes token request parameters. However, concurrent requests with varying `TokenRequestParameters` will result in the same token for all concu
- Product
- foss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing aCVE-2025-24399 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as case-insensitive, allowing attackers on Jenkins instances configured with a case-sensitive OpenID Connect provider to log in as any user by providing a username that differs only in letter case, potentially gaining administrator access to Jenkins.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/CVE-2024-13301 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.
- Product
- OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024user_oidc app is an OpenID Connect user backend for Nextcloud.CVE-2024-52512 · Other software · nextcloud · reported by GitHubLow 3.3
user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.CVE-2024-52553 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens.CVE-2024-51987 · Other software · DuendeSoftware · reported by GitHubMedium 5.4
Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAccessTokenHttpClient` may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captured in pooled `HttpClient` instances, which may be used by a different user. Instead of using `AddUserAccessTokenHttpClient` to create an `HttpClient` that automatically adds a managed token to outgoing requests, you can use the `HttpConext.GetUserAccessTokenAsync` extension method or the `IUserTokenManagementService.GetAccessTokenAsync` method. This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- Duende.AccessTokenManagement
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time.CVE-2024-10318 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.1
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time. This flaw allows an attacker to fix a victim's session to an attacker-controlled account. As a result, although the attacker cannot log in as the victim, they can force the session to associate it with the attacker-controlled account, leading to potential misuse of the victim's session.
- Product
- NGINX OpenID Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core.CVE-2024-49755 · Other software · DuendeSoftware · reported by GitHubLow 3.1
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens. Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.
- Product
- IdentityServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvCVE-2024-47807 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to suCVE-2024-47806 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.1
Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, allowing attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core.CVE-2024-39694 · Other software · DuendeSoftware · reported by GitHubMedium 4.7
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use `IUrlHelper.IsLocalUrl` from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host.
- Product
- IdentityServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024OpenAM is an open access management solution.CVE-2024-41667 · Other software · OpenIdentityPlatform · reported by GitHubHigh 8.8
OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default OpenAM login, they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024user_oidc app is an OpenID Connect user backend for Nextcloud.CVE-2024-37886 · Other software · nextcloud · reported by GitHubMedium 5.4
user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024user_oidc app is an OpenID Connect user backend for Nextcloud.CVE-2024-37312 · Other software · nextcloud · reported by GitHubMedium 6.3
user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024oidcc is the OpenID Connect client library for Erlang.CVE-2024-31209 · Other software · erlef · reported by GitHubMedium 5.3
oidcc is the OpenID Connect client library for Erlang. Denial of Service (DoS) by Atom exhaustion is possible by calling `oidcc_provider_configuration_worker:get_provider_configuration/1` or `oidcc_provider_configuration_worker:get_jwks/1`. This issue has been patched in version(s)`3.1.2` & `3.2.0-beta.3`.
- Product
- oidcc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2024OpenID: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31107 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DiSo Development Team OpenID allows Reflected XSS.This issue affects OpenID: from n/a through 3.6.1.
- Product
- OpenID
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update OpenID to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 13, 2024mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying PartyCVE-2024-24814 · Other software · OpenIDC · reported by GitHubHigh 7.5
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- mod_auth_openidc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024Dex is an identity service that uses OpenID Connect to drive authentication for other apps.CVE-2024-23656 · Other software · dexidp · reported by GitHubHigh 7.5
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.
- Product
- dex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50714 · Other software · yiisoft · reported by GitHubMedium 6.8
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0.CVE-2023-50708 · Other software · yiisoft · reported by GitHubMedium 6.1
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
- Product
- yii2-authclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.CVE-2023-1904 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.2
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Dec 13, 2023Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowingCVE-2023-50771 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Dec 13, 2023Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, CVE-2023-50770 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.7
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Sep 29, 2023A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arCVE-2023-44469 · Other software · Lemonldap-ng · reported by MITREMedium 4.3
A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to send GET requests to arbitrary URLs through the request_uri authorization parameter. This is similar to CVE-2020-10770.
- Product
- Lemonldap\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.ow2.orggitlab.ow2.org
Aug 4, 2023A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests.CVE-2023-0264 · Other software · redhat.com · reported by Red HatMedium 5
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.
- Product
- Keycloak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 20, 2023Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services SecCVE-2023-37471 · Other software · OpenIdentityPlatform · reported by GitHubCritical 9.1
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.
- Product
- OpenAM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2023OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE).CVE-2023-37464 · Other software · OpenIDC · reported by GitHubHigh 8.6
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC).
- Product
- cjose
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orggithub.com
May 25, 2023user_oidc app is an OpenID Connect user backend for Nextcloud.CVE-2023-32074 · Other software · nextcloud · reported by GitHubHigh 8
user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality.CVE-2023-28625 · Other software · OpenIDC · reported by GitHubHigh 7.5
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.
- Product
- mod_auth_openidc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc.CVE-2023-1656 · Other software · ForgeRock Inc. · reported by psirt@forgerock.comHigh 7.5
Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc. OpenIDM and Java Remote Connector Server (RCS) LDAP Connector on Windows, MacOS, Linux allows Remote Services with Stolen Credentials.This issue affects OpenIDM and Java Remote Connector Server (RCS): from 1.5.20.9 through 1.5.20.13.
- Product
- OpenIDM and Java Remote Connector Server (RCS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackstage.forgerock.combackstage.forgerock.com
Jan 26, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's accCVE-2023-24446 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
- Product
- Jenkins OpenID Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.CVE-2023-24445 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
- Product
- Jenkins OpenID Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.CVE-2023-24444 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenID Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.CVE-2023-24424 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenId Connect Authentication Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability, which was classified as problematic, was found in michaelliao jopenid.CVE-2010-10006 · Other software · michaelliao · reported by VulDBLow 2.6
A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460.
- Product
- jopenid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x.CVE-2010-10008 · Other software · simplesamlphp · reported by VulDBLow 3.5
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file templates/trust.tpl.php. The manipulation of the argument StateID leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The identifier of the patch is 8365d48c863cf06ccf1465cc0a161cefae29d69d. It is recommended to upgrade the affected component. The identifier VDB-218473 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- simplesamlphp-module-openidprovider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid.CVE-2010-10002 · Other software · SimpleSAMLphp · reported by VulDBLow 3.1
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file templates/consumer.php of the component OpenID Handler. The manipulation of the argument AuthState leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is identified as d652d41ccaf8c45d5707e741c0c5d82a2365a9a3. It is recommended to upgrade the affected component. VDB-217170 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- simplesamlphp-module-openid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server.CVE-2022-23527 · Other software · zmartzone · reported by GitHubMedium 4.7
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- Product
- mod_auth_openidc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022user_oidc is an OpenID Connect user backend for Nextcloud.CVE-2022-39339 · Other software · nextcloud · reported by GitHubMedium 4.3
user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2022user_oidc is an OpenID Connect user backend for Nextcloud.CVE-2022-39338 · Other software · nextcloud · reported by GitHubLow 3.5
user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this endpoint. Additionally this vulnerability has only been shown to be exploitable in the Safari web browser. This issue has been addressed in version 1.2.1. Users are advised to upgrade. Users unable to upgrade should urge their users to avoid using the Safari web browser.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2022XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki.CVE-2022-39387 · Other software · xwiki-contrib · reported by GitHubCritical 9.1
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based OpenID provider with oidc.xwikiprovider. With the same approach, one could also provide a specific group mapping through oidc.groups.mapping that would make his user automatically part of the XWikiAdminGroup. This issue has been patched, please upgrade to 1.29.1. There is no workaround, an upgrade of the authenticator is required.
- Product
- oidc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2022Dex is an identity service that uses OpenID Connect to drive authentication for other apps.CVE-2022-39222 · Other software · dexidp · reported by GitHubCritical 9.3
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- dex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."CVE-2022-34298 · Other software · Openidentityplatform · reported by MITREMedium 5.3
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
- Product
- Openam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect.CVE-2022-24794 · Other software · auth0 · reported by GitHubHigh 7.5
Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.
- Product
- express-openid-connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.CVE-2021-45786 · Other software · Maccms · reported by MITRECritical 9.8
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.CVE-2021-45325 · Other software · Gitea · reported by MITREHigh 7.5
Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.iogithub.com
Jan 6, 2022If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit coCVE-2021-44878 · Other software · Pac4j · reported by MITREHigh 7.5
If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.
- Product
- Pac4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.