CVE-2026-113373

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository 3 Pro versions prior to 3.98.0

Description The software fails to verify the local account status during authentication via SAML or OAuth2/OpenID Connect identity providers. This allows users whose accounts have been disabled or locked by an administrator to bypass these restrictions and establish a new session with the associated account roles by providing valid identity provider credentials. An attacker requires a named account with valid credentials at the identity provider to exploit this issue.

Recommendations Update to version 3.98.0.