EUVD-2026-76741
GHSA-vfcm-4hjc-64rr
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only MitM required (AV:A/AC:H); forged tokens accepted deployment-wide justifies scope change (S:C) and I:H.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
4DescriptionCVE.org
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.
AnalysisAI
Improper certificate validation (CWE-295) in an ICS component's reverse proxy allows a network-adjacent attacker to impersonate the identity provider during token discovery, introspection, and credential exchange, resulting in forged authentication tokens being accepted across the deployment. The affected product is covered under ICS-CERT advisory ICSA-26-254-01, indicating an industrial or operational technology context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be positioned on the network path between the reverse proxy and the identity provider service (AV:A) - this is not remotely exploitable over the internet without prior foothold on an adjacent network segment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.0 with vector AV:A/AC:H reflects that exploitation is constrained to attackers who can achieve network adjacency between the proxy and IdP, with high attack complexity due to the required MitM positioning - even a mid-sized municipal IT team in mielec should treat this as urgent if their OT network segment is not properly isolated, since adjacency requirements are frequently met in flat ICS environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult ICS-CERT advisory ICSA-26-254-01 at the CISA CSAF repository (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json) for the vendor-released patch version and official upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today