CVE-2025-11850

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim, such as username or email, exists in both the primary and a secondary store. This can lead to identity confusion when using an external Identity Provider (IDP), where legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.