Disabled Nexus Repository 3 accounts can sign in through single sign-on
Priority LOW 39CWE-1390Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Sonatype Nexus Repository 3 Pro from 3.86.0 before 3.98.0 does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator can sign in again with valid identity provider credentials for that account and receive a new session with the account's roles. The attacker needs a named account with valid credentials at the identity provider, and no Nexus Repository session or privilege. This flaw is classified as CWE-1390 (Weak Authentication).
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
Why it matters now
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed Nexus Repository 3 (Sonatype): 3.98.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.86.0 to before 3.98.0 | 3.98.0 | Patch available | CNA |
- Nexus Repository 3 VendorSonatype Affected 3.86.0 to before 3.98.0 Fixed in 3.98.0 Patch available CNA
CPE names CNA · 41
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:* | 3.86.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.86.1:*:*:*:*:*:*:* | 3.86.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:* | 3.86.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.86.3:*:*:*:*:*:*:* | 3.86.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:* | 3.87.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:* | 3.87.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.87.2:*:*:*:*:*:*:* | 3.87.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:* | 3.88.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:* | 3.88.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0:*:*:*:*:*:*:* | 3.89.0 | — | Sonatype |
- cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:* Versions 3.86.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.86.1:*:*:*:*:*:*:* Versions 3.86.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:* Versions 3.86.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.86.3:*:*:*:*:*:*:* Versions 3.86.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:* Versions 3.87.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:* Versions 3.87.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.87.2:*:*:*:*:*:*:* Versions 3.87.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:* Versions 3.88.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:* Versions 3.88.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0:*:*:*:*:*:*:* Versions 3.89.0 — ·Sonatype
Show 31 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1:*:*:*:*:*:*:* | 3.89.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:* | 3.90.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:* | 3.90.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:* | 3.90.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:* | 3.90.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:* | 3.90.4 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:* | 3.90.5 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:* | 3.91.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:* | 3.91.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:* | 3.92.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:* | 3.92.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:* | 3.92.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:* | 3.92.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:* | 3.93.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:* | 3.93.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:* | 3.93.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:* | 3.94.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:* | 3.94.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:* | 3.94.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:* | 3.95.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:* | 3.95.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:* | 3.95.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:* | 3.95.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:* | 3.95.4 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:* | 3.96.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:* | 3.96.1 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:* | 3.96.2 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:* | 3.96.3 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:* | 3.96.4 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:* | 3.97.0 | — | Sonatype |
| cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:* | 3.97.1 | — | Sonatype |
- cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1:*:*:*:*:*:*:* Versions 3.89.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:* Versions 3.90.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:* Versions 3.90.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:* Versions 3.90.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:* Versions 3.90.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:* Versions 3.90.4 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:* Versions 3.90.5 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:* Versions 3.91.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:* Versions 3.91.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:* Versions 3.92.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:* Versions 3.92.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:* Versions 3.92.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:* Versions 3.92.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:* Versions 3.93.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:* Versions 3.93.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:* Versions 3.93.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:* Versions 3.94.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:* Versions 3.94.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:* Versions 3.94.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:* Versions 3.95.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:* Versions 3.95.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:* Versions 3.95.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:* Versions 3.95.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:* Versions 3.95.4 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:* Versions 3.96.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:* Versions 3.96.1 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:* Versions 3.96.2 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:* Versions 3.96.3 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:* Versions 3.96.4 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:* Versions 3.97.0 — ·Sonatype
- cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:* Versions 3.97.1 — ·Sonatype
Remediation
Upgrade Sonatype Nexus Repository 3 to version 3.98.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Nexus Repository 3 (Sonatype) Fixed in 3.98.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Sonatype Nexus Repository 3 3.98.0
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2026-85150 Privilege escalation in Nexus Repository 3 via Rut Auth capabilityPriority LOW 37
- TI-2026-85146 SQL injection in Nexus Repository 3 reindex search taskPriority LOW 33
- TI-2026-85148 Nexus Repository 3 exposes YUM repository signing keys to read usersPriority LOW 31
Timeline
- 2026-11-04 Threatist record created from CVE-2026-113373
- 2026-11-04 Alias added: GHSA-wcg2-hr8x-qqgg
- 2026-11-06 Priority changed: MEDIUM → LOW
References
More Sonatype vulnerabilities
- TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
- TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
- TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
- TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
- TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
Sources
- CVE-2026-113373 · CVE Program
- CVE-2026-113373 · NVD
- FIRST EPSS
- GHSA-wcg2-hr8x-qqgg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences