{"items":[{"id":"NVI-00002794","kind":"vulnerability","title":"OpenID Connect nonce generated but never validated — ID token replay attack","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-3gx8-q682-38mx","CVE-2026-42206"],"plain_summary":"OSV carries this publisher advisory for roadiz/openid, roadiz/openid, roadiz/openid, roadiz/openid. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.7.18 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.6.31 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.5.45 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.3.43 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0ccd209e7cf020ed9b789cf731b8f23c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T18:10:00.173Z","value":"5.7 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-a343282f1b3ebef884d2da6d35f59073"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.152%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.04414. Missing scores are unknown.","source_id":"sr-0ccd209e7cf020ed9b789cf731b8f23c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2706d0cf517fb22188d6fe51fa25e9d3","url":"https://github.com/advisories/GHSA-3gx8-q682-38mx","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-3gx8-q682-38mx","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.656Z"},{"id":"sr-a343282f1b3ebef884d2da6d35f59073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42206","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-42206","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:02.489Z"},{"id":"sr-0ccd209e7cf020ed9b789cf731b8f23c","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-42206","publisher":"FIRST EPSS","observed_at":"2026-11-04T17:58:50.327Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.7.0; fixed 2.7.18"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.6.0; fixed 2.6.31"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.5.0; fixed 2.5.45"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.3.43"]}],"null_published_at":"2026-11-07T14:01:58.756Z","source_updated_at":"2026-05-13T13:55:48.291Z","source_disclosed_at":"2026-04-29T20:51:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.656Z"},{"id":"NVI-00002794","kind":"vulnerability","title":"OpenID Connect nonce generated but never validated — ID token replay attack","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-3gx8-q682-38mx","CVE-2026-42206"],"plain_summary":"OSV carries this publisher advisory for roadiz/openid, roadiz/openid, roadiz/openid, roadiz/openid. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.7.18 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.6.31 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.5.45 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.3.43 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-03f2d5bb2c7c84e19d2eb7e9c32268df"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T18:10:00.173Z","value":"5.7 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-a343282f1b3ebef884d2da6d35f59073"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.152%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.04364. Missing scores are unknown.","source_id":"sr-03f2d5bb2c7c84e19d2eb7e9c32268df"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2706d0cf517fb22188d6fe51fa25e9d3","url":"https://github.com/advisories/GHSA-3gx8-q682-38mx","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-3gx8-q682-38mx","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.656Z"},{"id":"sr-a343282f1b3ebef884d2da6d35f59073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42206","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-42206","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:02.489Z"},{"id":"sr-03f2d5bb2c7c84e19d2eb7e9c32268df","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-42206","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.278Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.7.0; fixed 2.7.18"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.6.0; fixed 2.6.31"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.5.0; fixed 2.5.45"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.3.43"]}],"null_published_at":"2026-11-06T15:18:17.653Z","source_updated_at":"2026-05-13T13:55:48.291Z","source_disclosed_at":"2026-04-29T20:51:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:49.656Z"},{"id":"NVI-00002794","kind":"vulnerability","title":"OpenID Connect nonce generated but never validated — ID token replay attack","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3gx8-q682-38mx","CVE-2026-42206"],"plain_summary":"OSV carries this publisher advisory for roadiz/openid, roadiz/openid, roadiz/openid, roadiz/openid. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.7.18 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.6.31 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.5.45 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.3.43 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-03f2d5bb2c7c84e19d2eb7e9c32268df"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.152%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.04364. Missing scores are unknown.","source_id":"sr-03f2d5bb2c7c84e19d2eb7e9c32268df"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2706d0cf517fb22188d6fe51fa25e9d3","url":"https://github.com/advisories/GHSA-3gx8-q682-38mx","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-3gx8-q682-38mx","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.656Z"},{"id":"sr-03f2d5bb2c7c84e19d2eb7e9c32268df","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-42206","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.278Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.7.0; fixed 2.7.18"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.6.0; fixed 2.6.31"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.5.0; fixed 2.5.45"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.3.43"]}],"null_published_at":"2026-11-02T20:21:07.779Z","source_updated_at":"2026-05-13T13:55:48.291Z","source_disclosed_at":"2026-04-29T20:51:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.656Z"},{"id":"NVI-00002794","kind":"vulnerability","title":"OpenID Connect nonce generated but never validated — ID token replay attack","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3gx8-q682-38mx","CVE-2026-42206"],"plain_summary":"OSV carries this publisher advisory for roadiz/openid, roadiz/openid, roadiz/openid, roadiz/openid. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.7.18 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.6.31 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.5.45 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 2.3.43 for roadiz/openid. Confirm the publisher’s latest guidance.","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2706d0cf517fb22188d6fe51fa25e9d3","url":"https://github.com/advisories/GHSA-3gx8-q682-38mx","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-3gx8-q682-38mx","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.656Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.7.0; fixed 2.7.18"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.6.0; fixed 2.6.31"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 2.5.0; fixed 2.5.45"]},{"certainty":"source_listed","source_ids":["sr-2706d0cf517fb22188d6fe51fa25e9d3"],"technology":"roadiz/openid","known_exclusions":[],"conditions_summary":"### Summary\nThe `roadiz/openid` package generates an OIDC nonce in `OAuth2LinkGenerator::generate()` and includes it in the authorization request sent to the identity provider, but **never stores it** and **never validates it** on the callback. The `OpenIdJwtConfigurationFactory` validation chain does not include a nonce constraint, and `OpenIdAuthenticator::authenticate()` never checks the nonce claim in the returned ID token against a stored value.\n\n### Details\nIn `src/OAuth2LinkGenerator.php`, a nonce is created and sent to the IdP:\n```php\n'nonce' => $this->tokenGenerator->generateToken(),\n```\nHowever, this value is neither stored in session, cache, nor any other persistent store.\n\nIn `src/OpenIdJwtConfigurationFactory.php`, the JWT validation constraints are:\n- `LooseValidAt` (expiry)\n- `PermittedFor` (audience)\n- `IssuedBy` (issuer)\n- `HostedDomain` (optional)\n- `UserInfoEndpoint` (optional)\n\n**No nonce constraint is present.**\n\nIn `src/Authentication/OpenIdAuthenticator.php`, the `authenticate()` method validates the state CSRF token correctly (fixed in v2.7.10), but never retrieves a stored nonce or compares it against the `nonce` claim in the ID token.\n\n### PoC\n1. Obtain a ","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.3.43"]}],"null_published_at":"2026-10-31T22:12:38.452Z","source_updated_at":"2026-05-13T13:55:48.291Z","source_disclosed_at":"2026-04-29T20:51:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:49.656Z"}],"next_cursor":null,"snapshot_revision":"42594"}