Joshua Rogers

**Name of the Vulnerable Software and Affected Versions** pac4j-oidc versions prior to 6.5.6 **Description** The software fails to verify access token signatures, issuers, audiences, or expiry during the extraction of Keycloak realm and client roles. This allows attackers to forge access tokens containing administrative roles and pair them with valid ID tokens to bypass authorization checks in applications that rely on pac4j role validation. **Recommendations** Update pac4j-oidc to version 6.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** pac4j-core versions prior to 6.5.6 **Description** An open redirect issue exists in the `DefaultLogoutLogic.perform()` function. The system accepts logout redirect targets that start with a backslash and match the `logoutUrlPattern`. This allows attackers to create logout links containing backslash-prefixed external hosts, which browsers normalize into network-path references, leading users to attacker-controlled websites after the logout process. **Recommendations** Update pac4j-core to version 6.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Rodauth versions prior to 2.47.0 **Description** Insufficient validation of protocol-relative return-to paths occurs within the `confirm password`, `login return to requested location`, and `two factor auth return to requested location` features. This allows attackers to use paths starting with double slashes, which browsers interpret as protocol-relative URLs, to redirect authenticated users to external malicious sites following password confirmation or login. **Recommendations** Update to version 2.47.0 or later.

**Name of the Vulnerable Software and Affected Versions** pac4j-core versions prior to 6.5.6 **Description** An authentication bypass exists in the `CheckProfileTypeAuthorizer` function, which reverses the profile type validation logic. This allows attackers to authenticate using a weaker client and gain access to resources that require a stronger profile type by satisfying generic profile checks. **Recommendations** Update pac4j-core to version 6.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** pac4j-oidc versions prior to 6.5.6 **Description** The software accepts OpenID Connect (OIDC) callbacks that contain only an access token, bypassing the required authorization code or ID token validation. This allows attackers to use access tokens intended for different clients to establish authenticated sessions because the system fails to verify the issuer, audience, nonce, or subject. **Recommendations** Update pac4j-oidc to version 6.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** Rodauth versions prior to 2.47.0 **Description** An authentication bypass exists in the 'jwt refresh' endpoint. The system issues new JSON Web Tokens (JWT)—which are compact, URL-safe means of representing claims to be transferred between two parties—without requiring a refresh token. An attacker can provide an access token to this endpoint using non-POST methods to obtain a new valid access token, allowing for indefinite account access if a temporary token is possessed. **Recommendations** Update to version 2.47.0 or later. Restrict access to the 'jwt refresh' endpoint to only allow POST methods as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** Rodauth versions prior to 2.47.0 **Description** The `otp` feature fails to track the timestamp of the last accepted code. This allows an attacker who observes a valid Time-based One-Time Password (TOTP) to replay that code within the drift window, enabling them to bypass the second authentication factor. **Recommendations** Update to version 2.47.0 or later.

**Name of the Vulnerable Software and Affected Versions** Rodauth versions prior to 2.47.0 **Description** An issue exists in the JSON request content type validation that allows a cross-site request forgery (CSRF) protection bypass. CSRF is a type of attack that tricks a victim into submitting a malicious request. Attackers can craft cross-origin form posts with content types containing `application/json` substrings to bypass token validation, potentially forcing victims to authenticate to accounts controlled by the attacker. **Recommendations** Update to version 2.47.0 or later.

**Name of the Vulnerable Software and Affected Versions** Rodauth versions prior to 2.46.0 **Description** An authentication bypass exists in the 'webauthn login' route. Logged-in users can authenticate as any other account due to improper account resolution logic. The system incorrectly falls back to session account identifiers instead of validating the credential binding, allowing attackers to complete authentication as arbitrary users. **Recommendations** Update to version 2.46.0 or later.

**Name of the Vulnerable Software and Affected Versions** pac4j-saml versions prior to 6.5.6 **Description** The software fails to require signature validation for SAML LogoutRequest messages within the `validateLogoutRequest()` function of the SAML2LogoutValidator. If an Identity Provider (IdP) does not send a `SessionIndex`, the system allows session destruction based only on the `NameID`. This enables an unauthenticated attacker to terminate a victim's SAML session by submitting an unsigned LogoutRequest using a guessed identifier, such as an email address used as the `NameID`. **Recommendations** Update pac4j-saml to version 6.5.6 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** An issue exists where the `mp SetEnddisc()` function copies a user-supplied PSN endpoint value without performing length validation. This flaw allows a buffer overflow via the ppp(8) command interface, which a local user can exploit to crash ppp(8) or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ppp (affected versions not specified) **Description** The `mp Enddisc()` function uses incorrect length calculations when formatting endpoint discriminator addresses for display. This flaw allows a received endpoint option to overflow a global result buffer, which could enable a malicious PPP peer to crash the `ppp(8)` process or potentially execute arbitrary code with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

**Name of the Vulnerable Software and Affected Versions** PDFio versions prior to 1.6.5 **Description** A dangling pointer issue exists in the dictionary string-formatting function. The software stores a pointer to a stack-local buffer in the document dictionary instead of copying the string value. In multi-threaded or pooled-request environments, this allows for stack memory reuse across requests, which can lead to cross-tenant document content corruption as one caller's dictionary string values are silently overwritten by another caller's data. **Recommendations** Update to version 1.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** jsoup versions prior to 1.23.2 **Description** An uncontrolled resource consumption issue exists in the `XmlTreeBuilder` function. A remote attacker can exhaust JVM heap memory by providing a deeply nested XML document containing uniquely-namespaced elements. This occurs because the builder copies the entire inherited namespace map at every start element, resulting in quadratic time and memory complexity. This can lead to an `OutOfMemoryError`, causing the application to terminate. **Recommendations** Update to a version that includes commit 862ba2f.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to commit 1cdeb3c **Description** A heap buffer overflow exists in the VC-2/Dirac RTP packetizer within the `libavformat/rtpenc vc2hq.c` file. The issue occurs because the packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without performing an upper bound check. An attacker can trigger memory corruption by supplying a specially crafted Dirac data unit during the process of packetizing input for RTP output. **Recommendations** Update FFmpeg to the version containing commit 1cdeb3c or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to commit b4c199c **Description** An incorrect integer narrowing conversion exists in the AV1 RTP packetizer within `libavformat/rtpenc av1.c`. The OBU (Open Bitstream Unit) size is cast to `long` before being compared to the remaining frame size. On platforms where `long` is 32 bits, such as 64-bit Windows, large OBU size values can be sign-flipped, resulting in a negative value that bypasses the payload size check. This allows an oversized OBU to exceed safety bounds, leading to out-of-bounds memory access when the value is used as a copy length. **Recommendations** Update FFmpeg to the version containing commit b4c199c or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to commit acf5d7c **Description** A heap buffer overflow exists in the hvcC box writer. This occurs when writing an HEVC configuration record containing more NAL units of a single type than the count field can represent, leading to a NAL unit count overflow. A specially crafted HEVC input file can trigger this overflow during the muxing process. **Recommendations** Update FFmpeg to the version containing commit acf5d7c or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to commit 1c10bcc **Description** A heap buffer overflow exists in the RIST protocol reader within `libavformat/librist.c`. The function `librist read()` fails to respect its size argument, copying the entire received payload length into the destination buffer. This leads to an overflow when the payload size exceeds the buffer capacity. The issue is accessible via the `async:rist://` URL scheme, where the async wrapper provides a buffer smaller than the incoming payload. A remote RIST sender can trigger this condition by sending a packet with a payload that exceeds the caller buffer size. **Recommendations** Update FFmpeg to the version containing commit 1c10bcc or later.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to commit 65b0dab **Description** An out-of-bounds read exists in the DASH demuxer within `libavformat/dashdec.c`. This occurs when a live DASH manifest is refreshed with a `startNumber` lower than the previous value, causing the current sequence number to become negative. Because the fragment retrieval function only verifies the upper bound before indexing the fragments array, a negative index can be used. A malicious or misconfigured DASH server can trigger this condition by providing a live manifest with a decreasing `startNumber` during a refresh. **Recommendations** Update FFmpeg to the version containing commit 65b0dab or later.