Vulnerabilities

TI-2025-20216 CVE-2025-27370 · GHSA-pcj4-9fcj-56c8

Authentication bypass in OpenID Connect

LOW 30

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.00345 Published 2025-03-03 No fix listed CWE-305

TI-2008-03142 CVE-2008-3280 · GHSA-cq23-cxpr-f49x

It was found that various OpenID Providers (OPs) had TLS Server Certificates that used…

LOW 33

It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03951 Published 2021-05-21 No fix listed CWE-338

TI-2019-08243 CVE-2019-11027 · GHSA-fqfj-cmh6-hj49

Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw.

MEDIUM 47

Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02968 Published 2019-06-10 Partial fix · 2.9.0 CWE-918

TI-2019-07220 CVE-2019-9837 · GHSA-vv4c-g6q7-p3q7

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and…

LOW 30

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error respons…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01349 Published 2019-03-15 Fixed in 1.5.4 CWE-601

TI-2011-03781 CVE-2011-4314 · GHSA-j473-c3rr-rx9p

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise…

LOW 32

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribut…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.03074 Published 2012-01-27 Partial fix · 0.9.6 CWE-20

TI-2007-04984 CVE-2007-5173 · GHSA-w67c-79jh-g7ff

PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in…

LOW 35

PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openid_root_path parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02798 Published 2007-10-03 No fix listed CWE-94

TI-2007-01592 CVE-2007-1652 · GHSA-3x88-xvgr-m6fg

OpenID allows remote attackers to forcibly log a user into an OpenID enabled site…

LOW 36

OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, and add it site to the trusted sites list via a crafted web page, related to cached…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01314 Published 2007-03-24 No fix listed

TI-2007-01591 CVE-2007-1651 · GHSA-f7mc-cw4j-gjxv

Cross-site request forgery (CSRF) vulnerability in OpenID allows remote attackers to…

LOW 33

Cross-site request forgery (CSRF) vulnerability in OpenID allows remote attackers to restore the login session of a user on an OpenID enabled site via unspecified vectors related to an arbitrary remote web site and cache…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0147 Published 2007-03-24 No fix listed

Vulnerabilities

Filters