Common Weakness Enumeration

CWE-1390

Allowed-with-Review

Weak Authentication

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

111 vulnerabilities reference this CWE, most recent first.

CVE-2026-121612 (GCVE-0-2026-121612)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:00 – Updated: 2026-11-09 17:24 X_Open Source
VLAI
Title
WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability
Summary
Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:20 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
WPZOOM WPBruiser {no- Captcha anti-Spam} Affected: 0 , ≤ 3.6.2 (custom)
Create a notification for this product.
Date Public
2026-11-07 16:38
Credits
Aarush Gaur | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121612",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T17:20:28.934453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T17:24:30.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "goodbye-captcha",
          "product": "WPBruiser {no- Captcha anti-Spam}",
          "vendor": "WPZOOM",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.6.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aarush Gaur | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-07T16:38:11.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.\u003cp\u003eThis issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.\u003c/p\u003e"
            }
          ],
          "value": "Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:00:20.004Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/goodbye-captcha/vulnerability/wordpress-wpbruiser-no-captcha-anti-spam-plugin-3-6-2-broken-authentication-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress WPBruiser {no- Captcha anti-Spam} plugin to the latest available version (at least 3.6.3)."
            }
          ],
          "value": "Update the WordPress WPBruiser {no- Captcha anti-Spam} plugin to the latest available version (at least 3.6.3)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress WPBruiser {no- Captcha anti-Spam} plugin \u003c= 3.6.2 - Broken Authentication vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-121612",
    "datePublished": "2026-11-09T17:00:20.004Z",
    "dateReserved": "2026-11-03T16:33:14.769Z",
    "dateUpdated": "2026-11-09T17:24:30.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115967 (GCVE-0-2026-115967)

Vulnerability from cvelistv5 – Published: 2026-10-29 11:00 – Updated: 2026-10-29 12:36 X_Open Source
VLAI
Title
WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability
Summary
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:18 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Hamid Alinia Login with phone number Affected: 0 , ≤ 1.8.78 (custom)
Create a notification for this product.
Date Public
2026-10-27 10:19
Credits
Peter Tang | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T12:18:39.566523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T12:36:52.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "login-with-phone-number",
          "product": "Login with phone number",
          "vendor": "Hamid Alinia",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.8.79",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.8.78",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Tang | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-27T10:19:39.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.\u003cp\u003eThis issue affects Login with phone number: from n/a through 1.8.78.\u003c/p\u003e"
            }
          ],
          "value": "Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T11:00:23.638Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/login-with-phone-number/vulnerability/wordpress-login-with-phone-number-plugin-1-8-78-broken-authentication-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Login with phone number plugin to the latest available version (at least 1.8.79)."
            }
          ],
          "value": "Update the WordPress Login with phone number plugin to the latest available version (at least 1.8.79)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Login with phone number plugin \u003c= 1.8.78 - Broken Authentication vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115967",
    "datePublished": "2026-10-29T11:00:23.638Z",
    "dateReserved": "2026-10-24T00:18:41.994Z",
    "dateUpdated": "2026-10-29T12:36:52.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113373 (GCVE-0-2026-113373)

Vulnerability from cvelistv5 – Published: 2026-11-04 20:01 – Updated: 2026-11-09 20:57
VLAI
Title
Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
Summary
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
Severity
9.1 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:56 UTC
CWE
Assigner
Sonatype CNA
References
Impacted products
Vendor Product Version
Sonatype Nexus Repository 3 Affected: 3.86.0 , < 3.98.0 (semver)
    cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.86.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.86.3:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.87.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*
    cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T20:56:57.439042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T20:57:07.768Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.87.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Nexus Repository 3",
          "vendor": "Sonatype",
          "versions": [
            {
              "lessThan": "3.98.0",
              "status": "affected",
              "version": "3.86.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.\u003c/p\u003e"
            }
          ],
          "value": "Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390 Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:01:19.624Z",
        "orgId": "103e4ec9-0a87-450b-af77-479448ddef11",
        "shortName": "Sonatype"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://support.sonatype.com/hc/en-us/articles/56614238092947/"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11",
    "assignerShortName": "Sonatype",
    "cveId": "CVE-2026-113373",
    "datePublished": "2026-11-04T20:01:19.624Z",
    "dateReserved": "2026-10-20T01:54:48.996Z",
    "dateUpdated": "2026-11-09T20:57:07.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110475 (GCVE-0-2026-110475)

Vulnerability from cvelistv5 – Published: 2026-10-26 12:20 – Updated: 2026-11-02 16:22
VLAI
Title
Improper Authentication Vulnerability in CreditNirvana Collections Platform
Summary
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:22 UTC
CWE
Assigner
CERT-In CNA
References
Impacted products
Vendor Product Version
CreditNirvana CreditNirvana Collections Platform (CollectionWorkz) Affected: All versions prior to 4.8.2
    cpe:2.3:a:creditnirvana:creditnirvana_collections_platform_collectionworkz_:all_versions_prior_to_4.8.2:*:*:*:*:*:*:*
Create a notification for this product.
Credits
This vulnerability is reported by Eaton Zveare.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T16:22:10.735804Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T16:22:24.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CreditNirvana Collections Platform (CollectionWorkz)",
          "vendor": "CreditNirvana",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 4.8.2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:creditnirvana:creditnirvana_collections_platform_collectionworkz_:all_versions_prior_to_4.8.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability is reported by Eaton Zveare."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.\n\u003cbr\u003eSuccessful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.\u0026nbsp;\u003cbr\u003e"
            }
          ],
          "value": "This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390 Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T12:20:36.675Z",
        "orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
        "shortName": "CERT-In"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0523"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade CreditNirvana Collections Platform to latest version 4.8.2\u003cbr\u003e"
            }
          ],
          "value": "Upgrade CreditNirvana Collections Platform to latest version 4.8.2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Authentication Vulnerability in CreditNirvana Collections Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
    "assignerShortName": "CERT-In",
    "cveId": "CVE-2026-110475",
    "datePublished": "2026-10-26T12:20:36.675Z",
    "dateReserved": "2026-10-14T07:43:11.707Z",
    "dateUpdated": "2026-11-02T16:22:24.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107244 (GCVE-0-2026-107244)

Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CWE
Assigner
hackerone CNA
References
Impacted products
Vendor Product Version
Versa VOS Affected: 21.1.1 , ≤ 21.2.3 (semver)
Affected: 22.1.2 , < July 2, 2026 (semver)
Affected: 22.1.3 , < July 2, 2026 (semver)
Affected: 22.1.4 , < July 2, 2026 (semver)
Affected: 23.1.2 , < July 2, 2026 (semver)
Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver)
Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver)
Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver)
Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver)
Create a notification for this product.
Credits
Microsoft
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "VOS",
          "vendor": "Versa",
          "versions": [
            {
              "lessThanOrEqual": "21.2.3",
              "status": "affected",
              "version": "21.1.1",
              "versionType": "semver"
            },
            {
              "lessThan": "July 2, 2026",
              "status": "affected",
              "version": "22.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "July 2, 2026",
              "status": "affected",
              "version": "22.1.3",
              "versionType": "semver"
            },
            {
              "lessThan": "July 2, 2026",
              "status": "affected",
              "version": "22.1.4",
              "versionType": "semver"
            },
            {
              "lessThan": "July 2, 2026",
              "status": "affected",
              "version": "23.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1.2 July-2-2026-Hotfix",
              "status": "unaffected",
              "version": "22.1.2 July-2-2026-Hotfix",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1.3 July-2-2026-Hotfix",
              "status": "unaffected",
              "version": "22.1.3 July-2-2026-Hotfix",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1.4 July-2-2026-Hotfix",
              "status": "unaffected",
              "version": "22.1.4 July-2-2026-Hotfix",
              "versionType": "semver"
            },
            {
              "lessThan": "23.1.2 Aug-3-2026-Hotfix",
              "status": "unaffected",
              "version": "23.1.2 Aug-3-2026-Hotfix",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Microsoft"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390 Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:32:36.935Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://security-portal.versa-networks.com/emailbulletins/6af22b38dd1c93ddc0a3e83a"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link:  \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-107244",
    "datePublished": "2026-11-10T00:32:36.935Z",
    "dateReserved": "2026-10-07T15:00:00.550Z",
    "dateUpdated": "2026-11-10T00:32:36.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107241 (GCVE-0-2026-107241)

Vulnerability from cvelistv5 – Published: 2026-11-10 00:32 – Updated: 2026-11-10 00:32
VLAI
Summary
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Severity
7.6 (High)
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CWE
Assigner
hackerone CNA
References
Impacted products
Vendor Product Version
Versa VOS Affected: 21.1.1 , ≤ 21.2.3 (semver)
Affected: 22.1.2 , < July 2, 2026 (semver)
Affected: 22.1.3 , < July 2, 2026 (semver)
Affected: 22.1.4 , < July 2, 2026 (semver)
Affected: 23.1.2 , < Aug 3, 2026 (semver)
Unaffected: 22.1.2 July-2-2026-Hotfix , < 22.1.2 July-2-2026-Hotfix (semver)
Unaffected: 22.1.3 July-2-2026-Hotfix , < 22.1.3 July-2-2026-Hotfix (semver)
Unaffected: 22.1.4 July-2-2026-Hotfix , < 22.1.4 July-2-2026-Hotfix (semver)
Unaffected: 23.1.2 Aug-3-2026-Hotfix , < 23.1.2 Aug-3-2026-Hotfix (semver)
Create a notification for this product.
Credits
NCSC Netherlands
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "VOS",
          "vendor": "Versa",
          "versions": [
            {
              "lessThanOrEqual": "21.2.3",
              "status": "affected",
              "version": "21.1.1",
              "versionType": "semver"
            },
            {
              "lessThan": "July 2, 2026",
              "status": "affected",
              "version": "22.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "July 2, 2026",
              "status": "affected",
              "version": "22.1.3",
              "versionType": "semver"
            },
            {
              "lessThan": "July 2, 2026",
              "status": "affected",
              "version": "22.1.4",
              "versionType": "semver"
            },
            {
              "lessThan": "Aug 3, 2026",
              "status": "affected",
              "version": "23.1.2",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1.2 July-2-2026-Hotfix",
              "status": "unaffected",
              "version": "22.1.2 July-2-2026-Hotfix",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1.3 July-2-2026-Hotfix",
              "status": "unaffected",
              "version": "22.1.3 July-2-2026-Hotfix",
              "versionType": "semver"
            },
            {
              "lessThan": "22.1.4 July-2-2026-Hotfix",
              "status": "unaffected",
              "version": "22.1.4 July-2-2026-Hotfix",
              "versionType": "semver"
            },
            {
              "lessThan": "23.1.2 Aug-3-2026-Hotfix",
              "status": "unaffected",
              "version": "23.1.2 Aug-3-2026-Hotfix",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "NCSC Netherlands"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.\u00a0 \n\nVersa\u2019s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390 Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T00:32:36.938Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://security-portal.versa-networks.com/emailbulletins/6af22a2fdd1c93ddc0a3e834"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "The mitigation is to disable the Nodejs web service on the VOS. Instructions to disable the Nodejs web service are available on the Versa documentation page at the below link: \n\n \n\nhttps://docs.versa-networks.com/Integrations_and_Solutions/System_Hardening/Perform_Manual_Hardening_for_Versa_Branches%2C_Controllers%2C_and_Hubs#Enable_Secure_Mode"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-107241",
    "datePublished": "2026-11-10T00:32:36.938Z",
    "dateReserved": "2026-10-07T15:00:00.550Z",
    "dateUpdated": "2026-11-10T00:32:36.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96940 (GCVE-0-2026-96940)

Vulnerability from cvelistv5 – Published: 2026-10-02 19:06 – Updated: 2026-10-31 18:07
VLAI
Title
Microsoft Exchange Server Elevation of Privilege Vulnerability
Summary
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:39 UTC
CWE
Assigner
microsoft CNA
References
Impacted products
Date Public
2026-10-02 14:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96940",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:39:06.809563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:41:49.319Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2016 Cumulative Update 23",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.01.2507.075",
              "status": "affected",
              "version": "15.01.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 14",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1544.048",
              "status": "affected",
              "version": "15.02.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server 2019 Cumulative Update 15",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.1748.053",
              "status": "affected",
              "version": "15.02.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Microsoft Exchange Server Subscription Edition RTM",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "15.02.2562.053",
              "status": "affected",
              "version": "15.02.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.1544.048",
                  "versionStartIncluding": "15.02.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*",
                  "versionEndExcluding": "15.01.2507.075",
                  "versionStartIncluding": "15.01.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.2562.053",
                  "versionStartIncluding": "15.02.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*",
                  "versionEndExcluding": "15.02.1748.053",
                  "versionStartIncluding": "15.02.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-02T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390: Weak Authentication",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T18:07:13.192Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Exchange Server Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940"
        }
      ],
      "title": "Microsoft Exchange Server Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2026-96940",
    "datePublished": "2026-10-02T19:06:19.061Z",
    "dateReserved": "2026-09-23T20:35:19.927Z",
    "dateUpdated": "2026-10-31T18:07:13.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94455 (GCVE-0-2026-94455)

Vulnerability from cvelistv5 – Published: 2026-09-22 16:17 – Updated: 2026-09-22 18:14
VLAI
Title
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
Summary
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user's own session token satisfies the check. Presented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation's API key in the response body. That key is immediately valid against the public API.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 18:13 UTC
CWE
Assigner
postiz CNA
References
Impacted products
Vendor Product Version
GitroomHQ postiz-app Affected: 0 , < 2.4.0 (semver)
Create a notification for this product.
Date Public
2026-09-22 14:36
Credits
Santosh Kumar Puppala Enno Gelhaus Nevo David
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:13:58.426768Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:14:13.947Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "postiz-app",
          "product": "postiz-app",
          "repo": "https://github.com/gitroomhq/postiz-app",
          "vendor": "GitroomHQ",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "You are affected if your deployment has billing enabled, that is if STRIPE_PUBLISHABLE_KEY or STRIPE_SECRET_KEY is set. This covers the hosted Postiz service and any self-hoster running Postiz commercially."
        },
        {
          "lang": "en",
          "value": "You are not meaningfully affected if you run a default self-hosted instance with no Stripe configuration. In that mode Postiz does not enforce subscription entitlements at all, so an organisation created through this endpoint holds no privileges your users do not already have."
        },
        {
          "lang": "en",
          "value": "Exposure is wider if self-registration is open, that is if DISABLE_REGISTRATION is unset or not set to \u0027true\u0027, because anyone on the internet can then obtain the account needed. With registration closed, the issue is reachable only by people who already hold an account on your instance."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Santosh Kumar Puppala"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Enno Gelhaus"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nevo David"
        }
      ],
      "datePublic": "2026-09-22T14:36:13.452Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes.\n\nThe endpoint\u0027s only check is that the request body carries a token bearing a valid signature from the instance secret. It does not check what that token was issued for. Login tokens are signed with the same secret and carry no purpose, audience or expiry claim, so an ordinary user\u0027s own session token satisfies the check.\n\nPresented with such a token, the endpoint creates a new organisation holding the highest subscription tier, flagged as lifetime and with a channel allowance far above any sold plan, creates an organisation-owner account alongside it, and returns the new organisation\u0027s API key in the response body. That key is immediately valid against the public API."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "1. Register an ordinary account on the target instance and capture that account\u0027s own login JWT."
        },
        {
          "lang": "en",
          "value": "2. POST /api/enterprise/create-user with body {\"params\": \"\u003cthat login JWT, verbatim\u003e\"}."
        },
        {
          "lang": "en",
          "value": "3. The response is 200 with {\"id\": \"\u003cnew organisation id\u003e\", \"apiKey\": \"\u003ckey\u003e\"}."
        },
        {
          "lang": "en",
          "value": "4. Confirm the new organisation carries subscriptionTier=ULTIMATE, isLifetime=true and totalChannels=1000000, and that it is distinct from the caller\u0027s own registration organisation."
        },
        {
          "lang": "en",
          "value": "5. Send the returned apiKey as the Authorization header against a public API endpoint and confirm 200, versus 401 for an invalid key."
        },
        {
          "lang": "en",
          "value": "Controls: an absent token, a malformed token, and a token with a valid-looking payload but a wrong signature all fail with no organisation created, confirming signature verification is the only gate."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Billing-integrity bypass. Any registered user can provision an organisation at the highest subscription tier, flagged as lifetime, with a channel allowance of 1,000,000 against the 100 provisioned for a genuine paying customer at that same tier."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Recurring unmetered resource consumption. The per-organisation AI allowance (500 image generations, 60 video generations, 600 clipping minutes) refills on a rolling monthly window, and the lifetime flag exempts the organisation from subscription reconciliation, so each provisioned organisation is an indefinite draw on the operator\u0027s model and GPU budget rather than a one-off."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Disclosure of a usable organisation API key in the response body, valid immediately against the public API without an interactive session."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "No confidentiality impact on existing tenants. The provisioned organisation is empty; no other organisation\u0027s channels, posts, media or account data become reachable."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-345",
              "description": "CWE-345",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-770",
              "description": "CWE-770",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:17:00.413Z",
        "orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
        "shortName": "postiz"
      },
      "references": [
        {
          "name": "Postiz",
          "tags": [
            "product"
          ],
          "url": "https://github.com/gitroomhq/postiz-app"
        },
        {
          "name": "v2.24.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.24.0"
        },
        {
          "name": "9259cf2",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gitroomhq/postiz-app/commit/9259cf2429e8cc0c88414e88d5e6c783d7ffba63"
        },
        {
          "name": "GAdvisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gadvisory.org/advisories/PSA-2026-P8W1J0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-21T13:34:00.000Z",
          "value": "Postiz has received and acknowledged the report."
        },
        {
          "lang": "en",
          "time": "2026-09-21T20:15:00.000Z",
          "value": "Postiz has verified the report."
        },
        {
          "lang": "en",
          "time": "2026-09-22T04:32:00.000Z",
          "value": "Postiz has developed and verified the patch."
        },
        {
          "lang": "en",
          "time": "2026-09-22T14:17:00.000Z",
          "value": "Postiz has released the patch notes and published the advisory."
        }
      ],
      "title": "Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key",
      "workarounds": [
        {
          "lang": "en",
          "value": "Block POST /enterprise/create-user, and preferably all of /enterprise/*, at your reverse proxy, ingress or WAF. If you do not use Postiz\u0027s enterprise or reseller provisioning integration, nothing legitimate calls these routes, so blocking them has no user-visible effect."
        },
        {
          "lang": "en",
          "value": "Set DISABLE_REGISTRATION=true. The caller needs an ordinary account on your instance to obtain a usable token, so closing self-registration limits exposure to people who already have one. This reduces reach, it does not close the issue."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
    "assignerShortName": "postiz",
    "cveId": "CVE-2026-94455",
    "datePublished": "2026-09-22T16:17:00.413Z",
    "dateReserved": "2026-09-21T17:10:50.156Z",
    "dateUpdated": "2026-09-22T18:14:13.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93355 (GCVE-0-2026-93355)

Vulnerability from cvelistv5 – Published: 2026-09-28 19:26 – Updated: 2026-10-01 15:21 X_Open Source
VLAI
Title
LiteLLM Weak JWT Authentication via Email-Based User Lookup
Summary
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_verified claim. Attackers can present a token with an unverified email address matching a victim's account to inherit the victim's role, including proxy_admin privileges, and permanently overwrite the victim's stored identity binding to retain persistent unauthorized access to administrative endpoints exposing API keys and user management.
Severity
7.6 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 14:01 UTC
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
BerriAI litellm Affected: 0 , ≤ 1.102.1 (semver)
Affected: 0 , ≤ f4308bc124eebc783dfc51790ce8db27ed21ae00 (git)
    cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-09-28 00:00
Credits
Nir Zadok (Nirza) and Moshe Siman Tov Bustan of OXsecurity
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93355",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T14:01:26.547066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T14:10:00.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageURL": "pkg:github/BerriAI/litellm",
          "product": "litellm",
          "repo": "https://github.com/BerriAI/litellm",
          "vendor": "BerriAI",
          "versions": [
            {
              "lessThanOrEqual": "1.102.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "f4308bc124eebc783dfc51790ce8db27ed21ae00",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.102.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nir Zadok (Nirza) and Moshe Siman Tov Bustan of OXsecurity"
        }
      ],
      "datePublic": "2026-09-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_verified claim. Attackers can present a token with an unverified email address matching a victim\u0027s account to inherit the victim\u0027s role, including proxy_admin privileges, and permanently overwrite the victim\u0027s stored identity binding to retain persistent unauthorized access to administrative endpoints exposing API keys and user management."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T15:21:59.696Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "OXsecurity Blog",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://www.ox.security/blog/litellm-an-ordinary-login-token-can-become-someone-elses-admin-account/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/litellm-weak-jwt-authentication-via-email-based-user-lookup"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "LiteLLM Weak JWT Authentication via Email-Based User Lookup",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-93355",
    "datePublished": "2026-09-28T19:26:01.155Z",
    "dateReserved": "2026-09-17T18:41:40.758Z",
    "dateUpdated": "2026-10-01T15:21:59.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92289 (GCVE-0-2026-92289)

Vulnerability from cvelistv5 – Published: 2026-09-25 00:15 – Updated: 2026-09-26 22:29
VLAI
Title
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret
Summary
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when the request carries no code_challenge, and token() admits the exchange as long as a challenge was stored or an authentication method was returned for the caller. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the method deduced from the request, so any Basic or form credential satisfies the secret branch. validatePKCEChallenge() then passes, because neither a challenge nor a verifier is present. An attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user's access, ID and refresh tokens by replaying the client_id with an arbitrary secret, which is the attack PKCE prevents. Dynamic client registration creates every Relying Party in this mode.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 15:38 UTC
CWE
Assigner
CPANSec CNA
References
Impacted products
Vendor Product Version
Affected: 2.23.0 , < 2.23.4 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-25T02:10:01.838Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/25/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-92289",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T15:38:54.575555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-26T22:29:08.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Lemonldap::NG::Portal"
          ],
          "packageName": "Lemonldap-NG-Portal",
          "packageURL": "pkg:cpan/Lemonldap-NG-Portal",
          "programFiles": [
            "lib/Lemonldap/NG/Portal/Lib/OpenIDConnect.pm",
            "lib/Lemonldap/NG/Portal/Issuer/OpenIDConnect.pm"
          ],
          "programRoutines": [
            {
              "name": "Lemonldap::NG::Portal::Lib::OpenIDConnect::checkEndPointAuthenticationCredentials"
            },
            {
              "name": "Lemonldap::NG::Portal::Issuer::OpenIDConnect::token"
            }
          ],
          "repo": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng",
          "versions": [
            {
              "lessThan": "2.23.4",
              "status": "affected",
              "version": "2.23.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in \"PKCE or secret\" mode because checkEndPointAuthenticationCredentials does not verify the client secret.\n\nWith oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when the request carries no code_challenge, and token() admits the exchange as long as a challenge was stored or an authentication method was returned for the caller. checkEndPointAuthenticationCredentials() skips the secret comparison for a Relying Party marked public and still returns the method deduced from the request, so any Basic or form credential satisfies the secret branch. validatePKCEChallenge() then passes, because neither a challenge nor a verifier is present.\n\nAn attacker who intercepts an authorization code issued to a public Relying Party can exchange it for the user\u0027s access, ID and refresh tokens by replaying the client_id with an arbitrary secret, which is the attack PKCE prevents. Dynamic client registration creates every Relying Party in this mode."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1390",
              "description": "CWE-1390 Weak Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T00:15:49.826Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3719"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Lemonldap-NG-Portal 2.23.4 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in \"PKCE or secret\" mode because checkEndPointAuthenticationCredentials does not verify the client secret",
      "workarounds": [
        {
          "lang": "en",
          "value": "For deployments that cannot upgrade to 2.23.4, set RequirePKCE to 1 on public Relying Parties so that a code challenge is always required. Relying Parties created through dynamic registration are always in \"PKCE or secret\" mode, so that endpoint has to be disabled as well."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-92289",
    "datePublished": "2026-09-25T00:15:49.826Z",
    "dateReserved": "2026-09-15T23:43:48.309Z",
    "dateUpdated": "2026-09-26T22:29:08.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list