Jaydns

Two domain-ownership flaws exist when the SSO plugin is active. If domain verification is disabled, automatic organization assignment accepts unverified provider domains. This allows an authenticated organization owner or administrator to register an SSO provider for any domain, causing users with matching email domains to be added to the attacker's organization with default member permissions. If domain verification is enabled, a race condition occurs between the 'verify-domain' and 'update-provider' endpoints, which can apply a completed DNS proof to an incorrect domain. When combined with implicit account linking, this allows an attacker-controlled identity provider to be linked to an existing user account. The organization plugin must also be enabled for the organization assignment path to be exploited.

A flaw in the SAML SSO implementation allows attackers to take over user accounts in multi-org instances through malicious Identity Providers. If a victim's email is known, an attacker can bypass authentication and link identities to gain unauthorized access.

LiteLLM, an AI Gateway proxy server for LLM APIs, contains a flaw where a database query used for API key checks incorporates caller-supplied values directly into the query text instead of using parameterized queries. An unauthenticated attacker can exploit this by sending a specially crafted `Authorization` header to any LLM API route, such as `POST /chat/completions`, reaching the vulnerable query via the proxy's error-handling path. This allows the attacker to read and potentially modify data within the proxy's database, specifically targeting tables like `litellm credentials`, `LiteLLM VerificationToken`, and `litellm config` to steal provider credentials and API keys. Real-world incidents show the issue was exploited within 36 hours of disclosure, with attackers using `UNION SELECT` payloads to extract sensitive information.

The 'POST /prompts/test' endpoint accepts user-supplied prompt templates and renders them without sandboxing. An authenticated user with a valid proxy API key can provide a crafted template to execute arbitrary code within the LiteLLM Proxy process. This may lead to the exposure of environment secrets, such as database credentials or provider API keys, and allow the execution of commands on the host system.

Cal.com, an open-source scheduling software, has a critical flaw in a custom NextAuth JWT callback. This issue allows attackers to gain full authenticated access to any user's account by supplying a target email address via the `session.update()` function. The vulnerability bypasses protections at the session token level, potentially enabling account takeover, including access to bookings, integrations, organizational access, billing, and administrative privileges. Approximately 7,000 instances are potentially affected. The issue allows attackers to overwrite identity fields during the `session.update()` process and impersonate any user. Two-factor authentication and identity providers do not prevent this post-authentication session hijack. The vulnerability is related to unvalidated email input in the `session.update()` function.