PT-2026-37178 · Roadiz · Roadiz

Athuljayaram · Published 2026-04-29 · Updated 2026-05-09 · CVE-2026-42206

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Roadiz versions prior to 2.3.43 Roadiz versions prior to 2.5.45 Roadiz versions prior to 2.6.31 Roadiz versions prior to 2.7.18

Description The roadiz/openid package fails to properly implement the OIDC nonce validation process. While the OAuth2LinkGenerator::generate() function creates a nonce and includes it in the authorization request sent to the identity provider, the value is not stored or validated during the callback. Specifically, the OpenIdJwtConfigurationFactory validation chain lacks a nonce constraint, and the OpenIdAuthenticator::authenticate() function does not verify the nonce claim in the returned ID token against a stored value. This allows for ID token replay attacks, where intercepted tokens are reused for authentication, and token injection attacks, where a compromised identity provider can inject tokens across sessions.

Recommendations Update to version 2.3.43. Update to version 2.5.45. Update to version 2.6.31. Update to version 2.7.18.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-42206

GHSA-3GX8-Q682-38MX

Affected Products

Roadiz

References · 5

• https://osv.dev/vulnerability/GHSA-3gx8-q682-38mx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42206 · Security Note
• https://github.com/roadiz/core-bundle-dev-app · Note
• https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-3gx8-q682-38mx · Note
• https://twitter.com/CVEnew/status/2053131430109286599 · Twitter Post