Skip to main content

1Password CVE-2021-26905

MEDIUM
Improper Authentication (CWE-287)
2021-02-08 cve@mitre.org
Authentication Bypass 1Password Scim Bridge
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Feb 08, 2021 - 20:15 nvd
MEDIUM 6.5

DescriptionNVD

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key.

AnalysisAI

1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. 1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key. Affected products include: 1Password Scim Bridge. Version information: before 1.6.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.

More in 1Password

View all
CVE-2018-13042 MEDIUM POC
5.9 Oct 05

The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. Rated medium severity (CVSS

CVE-2020-10256 CRITICAL
9.8 Oct 27

An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1
CVE-2012-6369 MEDIUM POC
4.3 Dec 28

Cross-site scripting (XSS) vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 mi
CVE-2024-42219 HIGH
7.8 Aug 06

1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communic
CVE-2021-41795 MEDIUM
6.5 Sep 29

The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization

CVE-2022-29868 MEDIUM
5.5 May 09

1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Rated medium severity (
CVE-2018-19863 MEDIUM
5.5 Dec 22

An issue was discovered in 1Password 7.2.3.BETA before 7.2.3.BETA-3 on macOS. Rated medium severity (CVSS 5.5), this vul
CVE-2021-36758 MEDIUM
5.4 Jul 16

1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access t
CVE-2022-32550 MEDIUM
4.8 Jun 15

An issue was discovered in AgileBits 1Password, involving the method various 1Password apps and integrations used to cre
CVE-2024-42218 MEDIUM
4.7 Aug 06

1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific securi

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2021-26905 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy