CVE-2026-9084General

LOWCVSS 6.0 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/MISP/MISP/commit/71f5662c1b5886613d2cd5c72fd93bb4ca6fa172

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

General: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

General

1100.0%

Referenced assets4 URLs

By indicator

Full discourse1 post

CERT Azerbaijan@CERTAzerbaijan140d
General
ETX əməkdaşı beynəlxalq kibertəhlükəsizlik platformasında boşluq aşkarlayıb. Ətraflı:https://www.instagram.com/p/DYl18mGIOHI/?igsh=MTJ0cDFycjBtcGZpdw== Mənbələr: https://www.cve.org/CVERecord?id=CVE-2026-9084 https://nvd.nist.gov/vuln/detail/CVE-2026-9084 https://www.thehackerwire.com/vulnerability/CVE-2026-9084/ #ETX #MilliCERT #CyberSecurity #Kibertəhlükəsizlik #CVE https://t.co/vjw0DIcT9J
Post summary
An ETX staff member reported discovering CVE-2026-9084, citing several reference links, but the post contains no further details on exploitation, mitigation, or technical aspects.
00010172
137 followersView on X

Explore more

Back to dashboard