https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 18:07:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318149 EUVD-2026-318149 https://cve.radiocsirt.org/vuln/euvd-2026-318149 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42206 <p>Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18, the roadiz/openid package generates an OIDC nonce in OAuth2LinkGenerator::generate() and includes it in the authorization request sent to the identity provider, but never stores it and never validates it on the callback. The OpenIdJwtConfigurationFactory validation chain does not include a nonce constraint, and OpenIdAuthenticator::authenticate() never checks the nonce claim in the returned ID token against a stored value. This issue has been patched in versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18.</p> <p>Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18, the roadiz/openid package generates an OIDC nonce in OAuth2LinkGenerator::generate() and includes it in the authorization request sent to the identity provider, but never stores it and never validates it on the callback. The OpenIdJwtConfigurationFactory validation chain does not include a nonce constraint, and OpenIdAuthenticator::authenticate() never checks the nonce claim in the returned ID token against a stored value. This issue has been patched in versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42206 https://cve.radiocsirt.org/vuln/ghsa-3gx8-q682-38mx <p><strong>Affected:</strong> Packagist: roadiz/openid</p> <p>### Summary The `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.</p> <p>### Details In `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP: ```php &#39;nonce&#39; =&gt; $this-&gt;tokenGenerator-&gt;generateToken(), ``` However, this value is neither stored in session, cache, nor any other persistent store.</p> <p>In `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are: - `LooseValidAt` (expiry) - `PermittedFor` (audience) - `IssuedBy` (issuer) - `HostedDomain` (optional) - `UserInfoEndpoint` (optional)</p> <p>**No nonce constraint is present.**</p> <p>In `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.</p> <p>### PoC 1. Obtain a valid ID token from a legitimate OIDC flow for a target user (e.g. via network interception, browser history leak, or referrer header exposure on a non-HTTPS redirect). 2. Replay the ID token: Since the nonce in the token is never cross-checked against a client-stored value, the token passes all va…</p> <p><strong>Affected:</strong> Packagist: roadiz/openid</p> <p>### Summary The `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.</p> <p>### Details In `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP: ```php &#39;nonce&#39; =&gt; $this-&gt;tokenGenerator-&gt;generateToken(), ``` However, this value is neither stored in session, cache, nor any other persistent store.</p> <p>In `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are: - `LooseValidAt` (expiry) - `PermittedFor` (audience) - `IssuedBy` (issuer) - `HostedDomain` (optional) - `UserInfoEndpoint` (optional)</p> <p>**No nonce constraint is present.**</p> <p>In `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.</p> <p>### PoC 1. Obtain a valid ID token from a legitimate OIDC flow for a target user (e.g. via network interception, browser history leak, or referrer header exposure on a non-HTTPS redirect). 2. Replay the ID token: Since the nonce in the token is never cross-checked against a client-stored value, the token passes all va…</p> https://cve.radiocsirt.org/vuln/ghsa-3gx8-q682-38mx