Identity Management Archives • Daily CyberSecurity

Apache Syncope Vulnerabilities Threaten Identity Management

Do Son September 16, 2026

Six Apache Syncope vulnerabilities, including CVE-2026-82232, expose severe identity management flaws. Patch your Apache Syncope servers immediately.

Apache Syncope Patches SQL Injection and Privilege Escalation Flaws Apache Syncope vulnerabilities including a privilege escalation flaw fixed in CVE-2026-57308 and CVE-2026-62183

Apache Syncope vulnerabilities including a privilege escalation flaw fixed in CVE-2026-57308 and CVE-2026-62183

Apache Syncope Patches SQL Injection and Privilege Escalation Flaws

Do Son July 23, 2026

Apache Syncope patches an SQL injection (CVE-2026-57308) and a privilege escalation flaw (CVE-2026-62183). Update to 4.0.7 or 4.1.2 to stay safe.

Severe Casdoor Identity Platform Flaws Expose Corporate Networks Casdoor authentication bypass flaws cross organization privilege escalation

Casdoor authentication bypass flaws cross organization privilege escalation

Severe Casdoor Identity Platform Flaws Expose Corporate Networks

Do Son June 2, 2026

Critical Casdoor authentication bypass flaws allow cross organization privilege escalation. Learn how to secure your identity infrastructure today.

Keys to the Kingdom: Critical 9.9 CVSS Budibase Flaw Allows Total Tenant Takeover bui

Keys to the Kingdom: Critical 9.9 CVSS Budibase Flaw Allows Total Tenant Takeover

Do Son May 20, 2026

Budibase patches a critical 9.9 CVSS SCIM authorization bypass (CVE-2026-46425). Basic users can delete admins and hijack accounts. Update now!

Public PoC and Technical Details Disclosed for Apache Syncope RCE Apache Syncope RCE CVE-2025-57738

Public PoC and Technical Details Disclosed for Apache Syncope RCE

Do Son April 20, 2026

Apache Syncope CVE-2025-57738 allows root RCE via unsandboxed Groovy. Technical details and PoC are now public. Upgrade to v3.0.14 or 4.0.2 immediately.

Critical 9.8 Webex Flaw Lets Attackers Impersonate Any User Cisco Webex SSO Webex Impersonation Flaw

Critical 9.8 Webex Flaw Lets Attackers Impersonate Any User

Do Son April 16, 2026

Cisco Webex CVE-2026-20184 allows unauthenticated user impersonation via SSO flaw. Fix requires a manual certificate update in Control Hub. Act now!

OpenStack Keystone Flaw Grants Access to Disabled LDAP Users CVE-2024-44082 - OpenStack Ironic OpenStack Keystone LDAP Identity Service Vulnerability

CVE-2024-44082 - OpenStack Ironic OpenStack Keystone LDAP Identity Service Vulnerability

OpenStack Keystone Flaw Grants Access to Disabled LDAP Users

Do Son April 15, 2026

OpenStack Keystone vulnerability allows disabled LDAP users to authenticate. Logic flaw in attribute mapping affects releases up to 2026.1. Patch now!

OpenStack Keystone Flaw Grants Full S3 Access via Restricted Credentials, PoC Available Mistral policy bypass flaw arbitrary code execution CVE-2024-40767 Keystone Vulnerability S3 Bypass

OpenStack Keystone Flaw Grants Full S3 Access via Restricted Credentials, PoC Available

Do Son April 9, 2026

OpenStack Keystone CVE-2026-33551 allows low-privilege users to bypass role restrictions and seize full S3 bucket control. Patch your cloud environment now!

Critical Security Update: IBM Patches Multiple Vulnerabilities in Verify Identity and Access IBM Verify Root Escalation

Critical Security Update: IBM Patches Multiple Vulnerabilities in Verify Identity and Access

Do Son April 8, 2026

IBM patches critical flaws in Verify Identity Access, including a 9.3 CVSS root escalation and 8.1 auth bypass. Secure your identity gateway—update now!

Identity at Risk: Apache Syncope Patches Critical Login XSS & XXE Flaws

Do Son February 3, 2026

Apache patches XSS (CVE-2026-23794) & XXE flaws in Syncope. Vulnerability allows session hijacking via login page. Update to v3.0.16 or v4.0.4 now.

Critical ZITADEL Flaws (CVE-2025-67494, CVSS 9.3) Risk SSRF Internal Breach and Account Hijack via XSS ZITADEL Vulnerability CVE-2026-29191 CVE-2025-27507 ZITADEL SSRF, Login UI Hijack

ZITADEL Vulnerability CVE-2026-29191 CVE-2025-27507 ZITADEL SSRF, Login UI Hijack

Critical ZITADEL Flaws (CVE-2025-67494, CVSS 9.3) Risk SSRF Internal Breach and Account Hijack via XSS

Do Son December 10, 2025

ZITADEL patched three high-severity flaws. Critical SSRF (9.3) allows internal breach via x-forward-host; XSS and Host Header Injection risk account hijack. Update to v4.7.1 immediately.

Apache Syncope Flaw (CVE-2025-65998) Exposes Encrypted User Passwords Due to Hard-Coded AES Key

Do Son November 25, 2025

Apache warned of a Critical flaw (CVE-2025-65998) in Syncope. When AES is enabled for password storage, a hard-coded key allows attackers with database access to decrypt all user passwords. Update immediately.

CVE-2025-7493: Critical Flaw in FreeIPA Allows Host Users to Escalate to Domain Administrator

Do Son October 1, 2025

A critical flaw (CVE-2025-7493) in FreeIPA allows authenticated users to exploit Kerberos alias checks to gain full domain administrator privileges. Patch to v4.12.5 now.

Critical Privilege Escalation Flaw in FreeIPA Threatens Linux Domain Security FreeIPA, Privilege Escalation

Critical Privilege Escalation Flaw in FreeIPA Threatens Linux Domain Security

Do Son June 20, 2025

A critical flaw (CVE-2025-4404, CVSS 9.1) in FreeIPA allows authenticated users to escalate privileges to domain admin via Kerberos impersonation.