Skip to content
OpenAdvisories

Package · Packagist

roadiz/openid

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.7
    CVE-2026-42206

    Roadiz OpenID Connect nonce generated but never validated — ID token replay attack

    Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and 2.7.18, the roadiz/openid package generates an OIDC nonce in OAuth2LinkGenerator::generate() and includes it in the authorization request s…

    roadiz core-bundle-dev-app roadiz/openid Packagist