Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: a466350665 Clear all filters
TI-2026-84349 CVE-2026-121543 · GHSA-cfjx-qgfm-vmq8

Incorrect authorization in smart-sso PermissionFilter enables admin access

Priority MEDIUM 40

smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00486 Published 2026-11-03 No fix listed CWE-863
TI-2026-75408 CVE-2026-111622 · GHSA-7rfc-8j8f-xgwj

Open redirect in smart-sso lets attackers steal OAuth2 codes

Priority HIGH 68

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00429 Published 2026-10-16 No fix listed CWE-601