CVE-2026-90452

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Requests sent from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange fail to verify the server certificate of the identity provider. This allows an attacker positioned on the network path between the proxy and the identity provider to impersonate the identity provider and issue forged authentication tokens that the deployment will accept.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.