Description

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

Remediation

References

CVE-2026-9742

Related Vulnerabilities

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-25476)

Zenphoto Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2012-0993)

Joomla Improper Input Validation Vulnerability (CVE-2011-4911)

WordPress Plugin uContext for Amazon Cross-Site Request Forgery (3.9.1)

WordPress Plugin Fancy Product Designer-WooCommerce Cross-Site Request Forgery (4.7.5)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities CWE-1287 CVE-2026-9742