Openid

This hub aggregates every CVE we track for Openid, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Openid.

• CVE-2024-31107WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1Mar 31, 2024
• CVE-2023-50770Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the...6.7Dec 13, 2023
• CVE-2023-24446A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.8.8Jan 24, 2023
• CVE-2023-24444Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.9.8Jan 24, 2023
• CVE-2023-24445Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.6.1Jan 24, 2023
• CVE-2008-3280It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with ...5.9May 21, 2021
• CVE-2019-1003098A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers to initiate a connection to an at...6.5Apr 4, 2019
• CVE-2019-1003099A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows attackers with Overall/Read permission to initiate a connec...6.5Apr 4, 2019
• CVE-2010-3091The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote a...5.0Sep 29, 2010
• CVE-2010-3685The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which a...5.0Sep 29, 2010
• CVE-2010-3686The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attack...5.0Sep 29, 2010
• CVE-2008-6835Cross-site scripting (XSS) vulnerability in OpenID 5.x before 5.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.4.3Jun 27, 2009
• CVE-2008-6836Cross-site request forgery (CSRF) vulnerability in OpenID 5.x before 5x.-1.2, a module for Drupal, allows remote attackers to hijack the authentication of unspecified victims to delete OpenID ident...6.8Jun 27, 2009
• CVE-2008-0570The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authentication for doma...5.0Feb 5, 2008
• CVE-2007-5173PHP remote file inclusion vulnerability in includes/openid/Auth/OpenID/BBStore.php in phpBB Openid 0.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the openid_root_path para...6.8Oct 3, 2007