GHSA-53hj-r94p-8c8f
Low · 3.7CVSS
3.7
EPSS
—
Published
May 6, 2026
CISA due date
—
The record
Kanidm has non-constant-time comparison of OAuth2 client_secret
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | kanidm | 0 | 1.9.3 |
Related vulnerabilities
- GHSA-gpxg-fx2g-qxj2 Kanidm: Stored HTML injection in "passkey-enrolment" partial via displayname →… Also affects kanidm
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
- CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
- CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208
- CVE-2026-54872 Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2… CWE-208
- CVE-2026-87737 An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. CWE-208
- CVE-2026-84308 phpseclib is a PHP secure communications library. CWE-208