https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:49:34.743292+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-246233 EUVD-2026-246233 2026-10-07T18:49:34.745188+00:00 EUVD-2026-246233 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53003 fkie_cve-2025-53003 2026-10-07T18:49:34.745219+00:00

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results without scope verification. This has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc. This issue has been patched in version 1.8.0. A workaround for this vulnerability involves users forking and building the config api, patching it in their system following commit 92eea4d.

 https://cve.radiocsirt.org/vuln/ghsa-373j-mhpf-84wg GHSA-373j-mhpf-84wg — Janssen Config API returns results without scope verification 2026-10-07T18:49:34.745251+00:00

Affected: Maven: io.jans:jans-config-api-server

### Impact _What kind of vulnerability is it? Who is impacted?_ The configAPI is an internal service and hence should never be exposed to the internet. With that said, this is a serious vulnerability that has a large internal surface attack area that exposes all sorts of information from the IDP including clients, users, scripts ..etc.

This affects all users of Janssen <1.8.0 and Gluu Flex <5.8.0

### Patches _Has the problem been patched? What versions should users upgrade to?_ All users are advised to upgrade immediately to [1.8.0](https://github.com/JanssenProject/jans/releases/tag/v1.8.0) for Janssen users and [5.8.0](https://github.com/GluuFederation/flex/releases/tag/v5.8.0) For Flex users.

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ The user can potentially fork and build the config api and patch it in their system following the commit here https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1

### References _Are there any links users can visit to find out more?_ https://github.com/JanssenProject/jans/issues/11575 https://github.com/JanssenProject/jans/commit/92eea4d4637f1cae16ad2f07b2c16378ff3fc5f1