Medium severity5.3NVD Advisory· Published Sep 11, 2026· Updated Oct 2, 2026
CVE-2026-90452
CVE-2026-90452
Description
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
2- 24 Vulnerabilities Disclosed Across Multiple Products: Authentication, Injection, and Credential Flaws ExposedVypr Intelligence · Sep 11, 2026
- CISA MalcolmCISA ICS Advisories