Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-46327 State: PUBLISHED Published: 2025-04-28T22:33:05.249Z Last Updated: 2025-04-29T13:43:12.167Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: snowflakedb Products: gosnowflake Problem Types: CWE-367 Description: gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race co
verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 1.13.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-6jgm-j7h2-2fqg - https://github.com/snowflakedb/gosnowflake/commit/ba94a4800e23621eff558ef18ce4b96ec5489ff0
CVE ID: CVE-2025-46328 State: PUBLISHED Published: 2025-04-28T22:33:09.632Z Last Updated: 2025-04-29T13:41:29.830Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: snowflakedb Products: snowflake-connector-nodejs Problem Types: CWE-367 Description: snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was
. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 2.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-wmjq-jrm2-9wfr - https://github.com/snowflakedb/snowflake-connector-node
flake-connector-nodejs/security/advisories/GHSA-wmjq-jrm2-9wfr - https://github.com/snowflakedb/snowflake-connector-nodejs/commit/e94c24112271e1f44c271634bf29a3188acc68d0
CVE ID: CVE-2025-46329 State: PUBLISHED Published: 2025-04-29T04:35:49.431Z Last Updated: 2025-04-29T13:34:10.233Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: snowflakedb Products: libsnowflakeclient Problem Types: CWE-532 Description: libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access author
ion of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. This issue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-jx4f-645p-wjpx - https://github.com/snowflakedb/libsnowflakeclient/commit/3caa8a6a3ee95e0a66ead03b4bf6a2d1ca42ebfe
CVE ID: CVE-2025-46330 State: PUBLISHED Published: 2025-04-29T04:34:37.061Z Last Updated: 2025-04-29T13:40:22.200Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: snowflakedb Products: libsnowflakeclient Problem Types: CWE-573 Description: libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, incorrectly treat malformed requests that caused the HTTP response status code 400, as able to be retried. This could hang the application until SF_CON_MAX_RETRY requests were sent. This issue has been patched in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/li
hed in version 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-ch37-53v3-m4cm - https://github.com/snowflakedb/libsnowflakeclient/pull/882/commits/8120a057e041722e114ed2c5dbed3b5a649f72e2
CVE ID: CVE-2025-46331 State: PUBLISHED Published: 2025-04-30T18:27:05.921Z Last Updated: 2025-05-01T18:52:23.855Z Vendors: openfga Products: openfga Problem Types: CWE-284 Description: OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been patched in version 1.8.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6 - https://github.com/openfga
t: References: - https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6 - https://github.com/openfga/openfga/commit/244302e7a8b979d66cc1874a3899cdff7d47862f
CVE ID: CVE-2025-46332 State: PUBLISHED Published: 2025-05-02T17:06:35.443Z Last Updated: 2025-05-02T17:47:34.845Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: vercel Products: flags Problem Types: CWE-200 Description: Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (.well-known/vercel/flags). This vulnerability allows for information disclosure, where a bad actor could gain access to a list
known/vercel/flags). This vulnerability allows for information disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the flag names, flag descriptions, available options and their labels (e.g. true, false), and default flag values. This issue has been patched in flags@4.0.0, users of flags and @vercel/flags should also migrate to flags@4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vercel/flags/security/advisories/GHSA-892p-pqrr-hxqr - https://github.com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md - https://vercel.com/changelog/information-disclosure-
com/vercel/flags/blob/main/packages/flags/guides/upgrade-to-v4.md - https://vercel.com/changelog/information-disclosure-in-flags-sdk-cve-2025-46332
CVE ID: CVE-2025-46333 State: PUBLISHED Published: 2025-04-25T20:20:22.202Z Last Updated: 2025-04-28T14:17:45.653Z Vendors: vancluever Products: z2d Problem Types: CWE-119, CWE-122, CWE-190 Description: z2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when writing from one surface to another using `z2d.compositor.StrideCompositor.run`, and higher-level operations when the anti-aliasing mode is set to `.default` (such as `Context.fill`, `Context.stroke`, `painter.fill`, and `painter.stroke`), the source surface can be completely out-of-bounds on the x-axis, but not on the y-axis, by way of a negative offset. This results in an overflow of t
letely out-of-bounds on the x-axis, but not on the y-axis, by way of a negative offset. This results in an overflow of the value controlling the length of the stride. In non-safe optimization modes (consumers compiling with `ReleaseFast` or `ReleaseSmall`), this could potentially lead to invalid memory accesses or corruption. This issue is patched in version `0.6.1`. Users on an untagged version after `v0.5.1` and before `v0.6.1` are advised to update to address the vulnerability. Those still on Zig `0.13.0` are recommended to downgrade to `v0.5.1`. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vancluever/z2d/security/advisories/GHSA-mm4c-p35v-7hx3 - htt
: - CISA ADP Vulnrichment: References: - https://github.com/vancluever/z2d/security/advisories/GHSA-mm4c-p35v-7hx3 - https://github.com/vancluever/z2d/issues/104 - https://github.com/vancluever/z2d/issues/105
CVE ID: CVE-2025-46334 State: PUBLISHED Published: 2025-07-10T15:06:12.757Z Last Updated: 2025-11-04T21:10:48.281Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: j6t Products: git-gui Problem Types: CWE-78 Description: Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes the current directory. The mentioned programs are invoked when the user selects Git Bash or Browse Files from the menu. This vulnerability is fixed in
ioned programs are invoked when the user selects Git Bash or Browse Files from the menu. This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/j6t/git-gui/security/advisories/GHSA-7px4-9hg2-fvhx - https://github.com/j6t/git-gui/compare/dcda716dbc9c90bcac4611bd1076747671ee0906..a1ccd2512072cf52835050f4c97a4fba9f0ec8f9
CVE ID: CVE-2025-46335 State: PUBLISHED Published: 2025-05-05T18:23:59.872Z Last Updated: 2025-05-05T18:34:01.097Z Vendors: MobSF Products: Mobile-Security-Framework-MobSF Problem Types: CWE-79 Description: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. Version 4.3.3 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Sec
.3 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-mwfg-948f-2cc5 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6987a946485a795f4fd38cebdb4860b368a1995d
CVE ID: CVE-2025-46336 State: PUBLISHED Published: 2025-05-08T19:26:01.638Z Last Updated: 2025-05-08T20:18:38.555Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: rack Products: rack-session Problem Types: CWE-362, CWE-367, CWE-613 Description: Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even aft
running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj - https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g - https://github.com/rack/rack-session/commit/c28c4a8c1861d814e09f2ae48264ac4c40be2d3b
CVE ID: CVE-2025-46337 State: PUBLISHED Published: 2025-05-01T17:20:10.658Z Last Updated: 2025-05-26T18:03:45.346Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: ADOdb Products: ADOdb Problem Types: CWE-89 Description: ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pg_insert_id() with user-supplied data. This issue has been patched in version 5.22.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - C
ser-supplied data. This issue has been patched in version 5.22.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ADOdb/ADOdb/security/advisories/GHSA-8x27-jwjr-8545 - https://github.com/ADOdb/ADOdb/issues/1070 - https://github.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426
CVE ID: CVE-2025-46338 State: PUBLISHED Published: 2025-04-29T04:34:44.713Z Last Updated: 2025-04-29T13:37:57.632Z Vendors: advplyr Products: audiobookshelf Problem Types: CWE-79 Description: Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.21.0, an improper input handling vulnerability in the `/api/upload` endpoint allows an attacker to perform a reflected cross-site scripting (XSS) attack by submitting malicious payloads in the `libraryId` field. The unsanitized input is reflected in the server’s error message, enabling arbitrary JavaScript execution in a victim's browser. This issue has been patched in version 2.21.0. Additional Analyst Notes: - CISA ADP Vu
execution in a victim's browser. This issue has been patched in version 2.21.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-47g3-c5hx-2q3w - https://github.com/advplyr/audiobookshelf/commit/35870a01583b2947030f4e3d4ac769c3ff298386
CVE ID: CVE-2025-46339 State: PUBLISHED Published: 2025-06-04T20:04:54.504Z Last Updated: 2025-06-04T20:48:49.550Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-349 Description: FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not including the following variables: proxy address, proxy protocol, and whether SSL should be verified. Therefore it's possible to poison a favi
g variables: proxy address, proxy protocol, and whether SSL should be verified. Therefore it's possible to poison a favicon of a given feed by simply intercepting the response of the feed, and changing the website URL to one where a threat actor controls the feed favicon. Feed favicons can be replaced for all users by anyone. Version 1.26.2 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8f79-3q3w-43c4 - https://github.com/FreshRSS/FreshRSS/commit/3776e1e48f33e80eb4b674bb64b419caf3b5a4e2
CVE ID: CVE-2025-46340 State: PUBLISHED Published: 2025-05-05T18:35:37.852Z Last Updated: 2025-05-05T18:46:57.331Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: misskey-dev Products: misskey Problem Types: CWE-20, CWE-116 Description: Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in `UrlPreviewService` and `MkUrlPreview`, it is possible for an attacker to inject arbitrary CSS into the `MkUrlPreview` component. `UrlPreviewService.wrap` falls back to returning the original URL if it's using a protocol that is likely to not be understood by Mi
ervice.wrap` falls back to returning the original URL if it's using a protocol that is likely to not be understood by Misskey, IE something other than `http` or `https`. This both can de-anonymize users and_allow further attacks in the client. Additionally, `MkUrlPreview` doesn't escape CSS when applying a `background-image` property, allowing an attacker to craft a URL that applies arbitrary styles to the preview element. Theoretically, an attacker can craft a CSS injection payload to create a fake error message that can deceive the user into giving away their credentials or similar sensitive information. Version 2025.4.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP
or similar sensitive information. Version 2025.4.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-3p2w-xmv5-jm95 - https://github.com/misskey-dev/misskey/commit/d10fdfe9738b17a9d81037c031b40a2cc4cb8038
CVE ID: CVE-2025-46341 State: PUBLISHED Published: 2025-06-04T20:09:18.479Z Last Updated: 2025-06-04T20:49:32.880Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: FreshRSS Products: FreshRSS Problem Types: CWE-918 Description: FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the `Remote-User` header or the `X-WebAuth-User` header by making specially crafted requests via the add feed functionality and obtaining the CSRF token via XPath scraping. The attacker has to know the IP address of the proxied FreshRSS instance and the admin's user
token via XPath scraping. The attacker has to know the IP address of the proxied FreshRSS instance and the admin's username, while also having an account on the instance. An attacker can send specially crafted requests in order to gain unauthorized access to internal services. This can also lead to privilege escalation like in the demonstrated scenario, although users that have setup OIDC are not affected by privilege escalation. Version 1.26.2 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w3m8-wcf4-h8vm - https://github.com/FreshRSS/FreshRSS/commit/6bb8680ae0051b9a2ff344f17814f4
RSS/security/advisories/GHSA-w3m8-wcf4-h8vm - https://github.com/FreshRSS/FreshRSS/commit/6bb8680ae0051b9a2ff344f17814f4fa5d844628
CVE ID: CVE-2025-46342 State: PUBLISHED Published: 2025-04-30T14:55:13.124Z Last Updated: 2025-04-30T15:10:25.100Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: kyverno Products: kyverno Problem Types: CWE-1287 Description: Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations
GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kyverno/kyverno/security/advisories/GHSA-jrr2-x33p-6hvc - https://github.com/kyverno/kyverno/commit/3ff923b7756e1681daf73849954bd88516589194
CVE ID: CVE-2025-46343 State: PUBLISHED Published: 2025-04-29T04:35:16.684Z Last Updated: 2025-04-29T13:35:04.707Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: n8n-io Products: n8n Problem Types: CWE-79 Description: n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allows the server to respond with any MIME type, potentially enab
IME type could be controlled via a GET parameter. This allows the server to respond with any MIME type, potentially enabling malicious content to be interpreted and executed by the browser. An authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to text/html, the script executes in the context of the user’s session. This script could send a request to change the user’s email address in their account settings, effectively enabling account takeover. This issue has been patched in version 1.90.0. Additional Analyst Notes: - CISA ADP Vulnri
ly enabling account takeover. This issue has been patched in version 1.90.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/n8n-io/n8n/security/advisories/GHSA-c8hm-hr8h-5xjw - https://github.com/n8n-io/n8n/pull/14350 - https://github.com/n8n-io/n8n/pull/14685 - https://github.com/n8n-io/n8n/releases/tag/n8n%401.90.0
CVE ID: CVE-2025-46344 State: PUBLISHED Published: 2025-04-29T20:43:41.538Z Last Updated: 2025-04-30T13:17:43.169Z Vendors: auth0 Products: nextjs-auth0 Problem Types: CWE-613 Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke `.setExpirationTime` when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While the session cookie may expire or be cleared, the JWE remains valid. This issue has been patched in version 4.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/auth0/nextjs-
ched in version 4.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-pjr6-jx7r-j4r6 - https://github.com/auth0/nextjs-auth0/commit/a4f061aed02ffa132feca8adfbd11704df17e1c3 - https://github.com/auth0/nextjs-auth0/releases/tag/v4.5.1
CVE ID: CVE-2025-46345 State: PUBLISHED Published: 2025-05-01T17:20:24.010Z Last Updated: 2025-05-02T17:39:32.800Z Vendors: auth0-extensions Products: auth0-account-link-extension Problem Types: CWE-290 Description: Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue has been patched in versions 2.6.7, 2.7.0, and 3.0.0. It is recommended to upgrade to version 3.0.0 or greater. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g
ended to upgrade to version 3.0.0 or greater. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/auth0-extensions/auth0-account-link-extension/security/advisories/GHSA-j2jh-rqff-7vmg - https://github.com/auth0-extensions/auth0-account-link-extension/pull/187