ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

News

55 items in the last 3d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 139Advisory 130AI industry 94AI safety & security 78AI research 76Exploit / PoC 76Research 68Industry 59Malware 41Data breach 40Tools 37Policy & legal 31Threat actor 30Phishing & fraud 17
SeverityAllcritical 42high 195medium 195low 55info 474

Nonprofit that tracks meteors taken down by "critical blow" from a cyberattack

The International Meteor Organization says a cyberattack dealt a critical blow to its infrastructure, taking much of its site offline for weeks.

The International Meteor Organization (IMO), a nonprofit coordinating amateur and professional meteor observations since 1988, reported a cyberattack that took much of its website offline. The organization expects several weeks of partial downtime while transitioning to new infrastructure and is prioritizing fireball reporting through alternate channels. The attack vector and whether any data was accessed remain undisclosed; the IMO's observation databases and WGN journal are widely used in the field.

Ars Technica · Security · 1h agoData breach in the wild 2 sources

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.

SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.

SANS Internet Storm Center · 4h agoExploit / PoC

Data Broker Radaris Loses Domains in Privacy Fight

A New Jersey court ordered people-search broker Radaris to transfer radaris.com and a dozen related domains to Atlas Data Privacy over Daniel's Law violations.

On August 26, a New Jersey judge found Radaris failed to defend claims that it violated Daniel's Law, which protects law enforcement officials' personal data and imposes $1,000 fines per ignored removal request. The court ordered radaris.com and more than a dozen related broker domains transferred to plaintiff Atlas Data Privacy Corp. Radaris had delayed litigation using offshore shell entities and previously used a fictitious CEO named 'Gary Norden' in investor-facing press releases.

Krebs on Security · 4h agoPolicy & legal

Google security advisory (AV26-926)

Canadian Cyber Centre relays Google's Chrome 153.0.8010.48 stable channel update fixing unspecified desktop vulnerabilities.

The Canadian Centre for Cyber Security issued advisory AV26-926 noting that Google Chrome versions prior to 153.0.8010.48 are affected by vulnerabilities. The advisory provides no CVE details or exploitation information and encourages users and administrators to apply the stable channel desktop update for September 15, 2026.

Canadian Centre for Cyber Security · 5h agoAdvisory

Cisco Nexus Dashboard Software Security Hardening Release: September 2026

Cisco released Nexus Dashboard hardening updates for multiple internally discovered vulnerabilities, grouped by CWE and not known to be exploited.

Cisco's Nexus Dashboard engineering team conducted an internal security review that found multiple vulnerabilities, addressed via software hardening releases. The issues were discovered during internal testing and are not known to be actively exploited. Cisco grouped the issues by CWE class and assigned a single CVE ID per issue before releasing fixes.

Cisco Security Advisories · 6h agoAdvisory

Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

Cisco patched a BroadWorks CommPilot authorization bypass letting low-privileged authenticated users alter device configurations via crafted HTTP requests.

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software is caused by missing authorization checks. An authenticated remote attacker with low privileges can send crafted HTTP requests to alter configurations on select pages. Cisco has released software updates and no workarounds are available.

Cisco Security Advisories · 6h agoAdvisory

Cisco Identity Services Engine Information Disclosure Vulnerability

Cisco patched an ISE API flaw letting an authenticated administrator view sensitive data including hashed credentials via crafted API requests.

A vulnerability in the Cisco Identity Services Engine API allows an authenticated remote attacker with valid administrative credentials to view sensitive information, including hashed credentials usable in future attacks. The flaw is caused by insufficient validation of user-supplied API request parameters. Cisco has released software updates.

Cisco Security Advisories · 6h agoAdvisory 15 sources

Cisco Identity Services Engine Authorization Bypass Vulnerabilities

Cisco fixed authorization bypass flaws in ISE and ISE-PIC web management letting authenticated admins modify file descriptions via crafted HTTP requests.

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine and ISE Passive Identity Connector result from missing server-side validation of Administrator permissions. An authenticated remote attacker with valid Administrator credentials can submit crafted HTTP requests to modify descriptions of files on specific pages. Cisco has released software updates addressing the issues.

Cisco Security Advisories · 6h agoAdvisory 15 sources

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Cisco patched a reflected XSS in the ISE management interface allowing unauthenticated attackers to execute script via crafted links.

A reflected cross-site scripting vulnerability in the web-based management interface of Cisco Identity Services Engine lets an unauthenticated remote attacker execute arbitrary script in the context of the interface. Exploitation requires persuading a user to click a crafted link due to improper input validation. Cisco has released software updates.

Cisco Security Advisories · 6h agoAdvisory 15 sources

International Meteor Organization says cyberattack dealt ‘critical blow’ to website

A cyberattack forced the International Meteor Organization's website offline, with weeks of partial downtime expected during an infrastructure migration.

The Belgium-based International Meteor Organization (IMO), founded in 1988 to coordinate meteor observation standards and maintain a global fireball database, said a cyberattack took much of its aging infrastructure offline. The site now shows a static notice, and the organization expects several weeks of partial downtime while transitioning to new infrastructure, with the fireball reporting system prioritized and already restored. No hacking group has claimed responsibility. The incident follows 2023 attacks on the NOIRLab astronomy facility in Hawaii and the ALMA observatory in Chile, plus ransomware at the American Meteorological Society.

The Recordupdated · 1h agofirst · 7h agoData breach 2 sources

CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).

Apache NiFi 2.11.0 supports migrating version-controlled Process Group contents into a Connector via REST API methods that list eligible migration sources and submit migration requests. Both methods were authorized only against the target Connector, without evaluating user access to the involved Process Groups. The flaw, tracked as CVE-2026-86089, is rated Low severity and affects the nifi-web-api component.

oss-security · 7h agoVulnerability 3 sourcesCVE-2026-86089

CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

Apache NiFi 2.9.0-2.11.0 Connector configuration update and verification APIs skip authorization for referenced Assets and Secrets (CVE-2026-81866, Low).

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checks on Assets and Secrets referenced in the proposed configuration. Updating or verifying a Connector configuration can apply Asset and Secret references without the caller holding the required privileges. The issue, CVE-2026-81866, is rated Low severity and affects the nifi-web-api component.

oss-security · 7h agoVulnerability 3 sourcesCVE-2026-81866

Multiple vulnerabilities in Jenkins plugins

Jenkins releases security fixes for multiple plugins including Bitbucket, GitLab, Gitee, Coverage, and Gradle integrations.

Jenkins published security updates for several plugins, including Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, GitLab Plugin 1.2152.veec0897048b_0, and the Gradle Plugin. The announcement is a routine open-source security release notice without exploit details.

oss-security · 7h agoVulnerability 2 sources1

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 9h agoResearch

Jenkins Security Advisory 2026-09-16

Jenkins released a security advisory patching vulnerabilities across 13 plugins, including GitLab, Bitbucket, Gradle, Keycloak Authentication, and Script Security.

The Jenkins security advisory dated September 16, 2026 addresses vulnerabilities in 13 plugins: Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, OWASP Dependency-Check, Pipeline: Groovy Libraries, Pipeline: Multibranch, Robot Framework, Script Security, and Warnings. Jenkins users should update the affected plugins to the patched versions listed in the advisory.

Jenkins Security Advisoriesupdated · 7h agofirst · 10h agoAdvisory 2 sources

USN-8773-1: GNU Guix vulnerability

Ubuntu issued USN-8773-1 fixing a GNU Guix flaw that exposed build outputs to local users before metadata finalization, enabling possible privilege escalation.

Ubuntu published security notice USN-8773-1 to address a flaw in GNU Guix where build outputs were made accessible to local users before their file metadata was finalized. A local attacker could possibly leverage this window to gain elevated privileges on the affected system. The notice ships updated packages for supported Ubuntu releases and reports no exploitation.

Ubuntu Security Noticesupdated · 2h agofirst · 11h agoAdvisory 15 sources

Hackers Stole Flock’s Camera Software, Revealing How the Company Tracks Cars and People

Hackers who removed a Flock Safety license plate camera dumped its data, revealing person-detection capabilities and an encryption key stored unencrypted on the device.

A hacker collective calling itself stegan0gram physically removed a Flock Safety automatic license plate reader camera from a roadway, copied its storage, and shared the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis found an encryption key in an unencrypted 'media' partition that unlocked videos of thousands of vehicle detections, with logs showing more than a million images generated in weeks. The software explicitly detects people, bicycles, and even bumper stickers, and records from one Georgia city were searchable by more than 2,000 agencies nationwide. The findings follow 2025 research by Jon Gaines documenting flaws enabling root-level access to Flock cameras.

404 Mediaupdated · 39m agofirst · 12h agoResearch in the wild 3 sources

AI helps scammers build convincing antivirus renewal pages

Malwarebytes found scammers using AI to build polished fake antivirus renewal pages impersonating Avast, harvesting names, emails and phone numbers for follow-up fraud calls.

Malwarebytes analyzed a fake Avast renewal site targeting Belgian users in French, claiming a €129.99 Avast Premium Security renewal and collecting name, email address and Belgian mobile number through a cancellation form. Leftover code comments written in polite French and other stylistic clues suggest the page was generated with AI assistance, and the form was never connected to send data anywhere. The scam typically progresses to phone calls pressuring victims to install remote access software, and AI substantially lowers the barrier for producing polished, localized scam pages at scale.

Malwarebytes Labs · 14h agoPhishing & fraud

Re: Retrospective by 'gpg.fail' authors

GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.

Lexi Groves, author of the gpg.fail talk, clarified on oss-security that the first finding was an actual zero-day: a classic printf injection using %n for memory writes, with multiple X.509 certificates in one PEM file to re-enter and defeat ASLR before calling execv@plt. The payload executed the certificate itself, a polyglot file made by inserting a shebang and bash command into the PEM. A second finding was hash-collided by another party before the author could exploit it.

oss-securityupdated · 5h agofirst · 22h agoResearch 8 sources

Re: Retrospective by 'gpg.fail' authors

GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.

Werner Koch replied to the gpg.fail retrospective, noting that GnuPG versions above 2.2 produce garbled stderr or crash when the project's certificates are used with --debug x509 because DER data is passed as a printf format string. Testing the certificates from the researchers' Git repo yielded only a segfault, not demonstrated code execution. Koch states how remote code execution would be achieved is unclear and asks for a real reproducer.

oss-securityupdated · 5h agofirst · 1d agoVulnerability 8 sources

USN-8766-1: Suricata-Update vulnerability

Ubuntu patches Suricata-Update path validation flaw allowing arbitrary file writes outside the rules directory from malicious rule archives.

Ubuntu security notice USN-8766-1 fixes a Suricata-Update vulnerability discovered by Guillem Lefait. The tool did not properly validate destination paths when extracting files referenced by downloaded rule archives, allowing an attacker to write arbitrary files outside the configured rules directory. Users are advised to update the suricata-update package.

Ubuntu Security Notices · 1d agoAdvisory

GNU security advisory (AV26-923)

Canadian Cyber Centre advisory AV26-923 flags a stack overflow in GNU libextractor before v1.15 via OLE2 files.

The Canadian Centre for Cyber Security issued advisory AV26-923 on September 15, 2026, covering CVE-2026-91752, a stack overflow vulnerability in GNU libextractor versions prior to 1.15 triggered via OLE2 file parsing. The Cyber Centre encourages users and administrators to review the provided links and apply necessary updates as they become available.

Canadian Centre for Cyber Security · 1d agoAdvisoryCVE-2026-91752

Google’s New Search Redirects Make It Harder to Check Where Links Lead Before Clicking

Malwarebytes reports Google's new encoded google.com/goto?url= redirects break hover-preview link checking, weakening a common phishing defense.

Google now routes some search results through opaque google.com/goto?url= redirects using custom encoding, so browser link previews no longer reveal the true destination, only the claimed label above the result. Malwarebytes found the final destination is visible only in the redirect response's Location header, complicating hover-based safety checks as well as scraping, archiving, and audit tools. The change arrives amid malvertising, search-result poisoning, and fake installer campaigns like the recent Node.js infostealer lure. Google says it deploys measures against evolving abuse but did not explain the change.

Cyber Security News · 1d agoResearch

USN-8761-1: Linux kernel (Azure) vulnerabilities

Ubuntu patches multiple Linux kernel (Azure) flaws across ARM64, Bluetooth, Netfilter, NTFS3, SMB and other subsystems.

Ubuntu security notice USN-8761-1 corrects several security issues in the Linux kernel for Azure, spanning ARM32, ARM64, and PowerPC architectures plus subsystems including Bluetooth, Netfilter, EFI core, GPU drivers, InfiniBand, SCSI, NTFS3, and SMB. An attacker could possibly use these flaws to compromise the system.

Ubuntu Security Notices · 1d agoAdvisory 2 sources

USN-8760-1: Linux kernel (NVIDIA) vulnerabilities

Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.

Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.

Ubuntu Security Notices · 1d agoAdvisory

Microsoft confirms KB5002914 Excel update breaks copy and paste

Microsoft confirms KB5002914 Office security update silently breaks copy-paste, autofill, and formula dragging in Excel 2016 through 2024.

Microsoft confirmed the September 2026 KB5002914 security update breaks copy-and-paste, autofill, and formula dragging in Excel 2024, 2021, 2019, and 2016. Failures occur silently with no beep or error message, leaving the destination unmodified. Uninstalling KB5002914 via OfficeC2RClient or Oarpmany restores functionality while Microsoft investigates.

BleepingComputerupdated · 1d agofirst · 1d agoAdvisory 3 sources1

Microsoft Releases Emergency Patch to Fix RDS Snafu

Microsoft's out-of-band KB5129195 fixes September Patch Tuesday regressions breaking RDS connections, Hyper-V shared folders, and USB audio.

Microsoft released cumulative out-of-band update KB5129195 on September 14, 2026, fixing RDS instability causing failing RDP connections, sign-in issues, and hanging servers. The patch also resolves Hyper-V Plan9 shared-folder failures affecting WSL and Claude Cowork, plus USB Audio Class 1.0 device failures. This is Microsoft's sixth emergency patch after a September Patch Tuesday that fixed a record 974 CVEs.

Infosecurity Magazine · 1d agoAdvisory 3 sources

Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

David Wheeler notes a rosbridge_library quadratic CPU cost flaw was publicly disclosed on oss-security without prior coordination.

In an oss-security reply, David A. Wheeler pointed out that a poster had just publicly disclosed details of a quadratic CPU cost issue in rosbridge_library's Protocol.incoming() JSON fallback path. Wheeler referenced the mailing list's stated norms encouraging public discussion of open-source security flaws. The reply itself contains no fix, CVE, or exploitation details.

oss-security · 2d agoVulnerability 3 sources

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · Security · 2d agoResearch

Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

Alan Coopersmith's mailing list reply merely points to the public oss-security posting of the rosbridge_library disclosure.

A follow-up reply on oss-security by Alan Coopersmith notes that the rosbridge_library Protocol.incoming() quadratic CPU cost issue was disclosed publicly on the oss-security mailing list. The reply contains no additional technical detail beyond linking the original disclosure.

oss-securityupdated · 2d agofirst · 2d agoVulnerability 3 sources

rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.

Evgenios Gkritsis disclosed an algorithmic-complexity defect in rosbridge_suite's rosbridge_library Protocol.incoming() JSON fallback path, classified as CWE-407/CWE-1050. The flaw exists in the current ros2 branch and was not removed by PR #1199, having been present since the fallback was introduced. Crafted input can drive quadratic CPU cost and cause denial of service.

oss-securityupdated · 2d agofirst · 2d agoVulnerability 3 sources1

Possible cyber incident disrupts Monroe schools in Wisconsin

Possible cyber incident forced the School District of Monroe in Wisconsin to cut internet access, knocking out phones and canceling an ACT testing session.

The School District of Monroe in Wisconsin disconnected its network after a possible network security issue. Students powered down computers, school phone service failed, and a scheduled ACT testing session was canceled. Classes continued while the district investigates the incident. No data theft or attacker claims have been confirmed so far.

DataBreaches.net · 2d agoData breach

visionOS 27.0 (24M362)

Apple ships visionOS 27.0 (build 24M362) for Vision Pro; release notice contains no security or CVE details.

Apple announced the general availability of visionOS 27.0, build 24M362, via its developer release feed. The notice contains only download and release-notes links with no vulnerability or CVE information. Defenders should consult the security release notes to determine if patches affect Apple Vision Pro devices.

Apple software releases · 2d agoAdvisory

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.

CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.

oss-security · 2d agoVulnerabilityCVE-2026-87802

CVE-2026-87785: Apache Syncope: JWT subject spoofing

Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.

CVE-2026-87785 is a low-severity authentication bypass by spoofing vulnerability in Apache Syncope related to the configured JWKS settings for internal JWT authentication. Affected versions are syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 2d agoVulnerabilityCVE-2026-87785

CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Apache Syncope's JEXL template engine permits one-hop navigation past the JexlContextBuilder name denylist, enabling administrator-driven information disclosure.

CVE-2026-77883 is a moderate-severity exposure of sensitive information through data queries in Apache Syncope's syncope-core-provisioning-api module. An administrator can bypass the JexlContextBuilder name denylist using one-hop JEXL navigation to reach sensitive data. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 2d agoVulnerabilityCVE-2026-778831

CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective

Apache Syncope discloses low-severity CVE-2026-77181, an incorrect authorization flaw where the ClientApp update entitlement is not effective in versions 3.0.x through 4.1.2.

Francesco Chicchiriccò posted a low-severity advisory for CVE-2026-77181, an Incorrect Authorization vulnerability in Apache Syncope's syncope-core-am-logic module. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. An administrator holding the ClientApp update entitlement finds it is not applied as expected. No exploitation is reported and the issue is rated low severity.

oss-security · 2d agoVulnerabilityCVE-2026-77181

CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection

Apache Syncope CVE-2026-73195 allows authenticated users to inject spreadsheet formulas into CSV exports.

Apache Syncope disclosed CVE-2026-73195, a moderate-rated improper encoding or escaping of output vulnerability. Authenticated users can inject spreadsheet formulas into data that is later exported as CSV, which may execute when an administrator opens the file in a spreadsheet application. The flaw affects syncope-core-provisioning-java in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 2d agoVulnerabilityCVE-2026-73195

CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers

Apache Syncope SRA CVE-2026-73191 enables CAS service URL injection via Forwarded HTTP headers.

Apache Syncope disclosed CVE-2026-73191, a moderate-rated open redirect vulnerability in the Syncope SRA. When the SRA is configured for CAS authentication, the target Apereo CAS service URL can be manipulated through Forwarded HTTP headers, redirecting users to an untrusted site. The flaw affects syncope-sra in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed releases.

oss-security · 2d agoVulnerabilityCVE-2026-73191