CVE-2026-42206
1 advisory.
Packagist/roadiz/openid CVE-2026-42206: medium
OpenID Connect nonce generated but never validated — ID token replay attack
Action: Upgrade roadiz/openid to 2.3.43 or later.
composer require roadiz/openid:2.7.18composer require roadiz/openid:2.6.31composer require roadiz/openid:2.5.45composer require roadiz/openid:2.3.43Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.7.0 | 2.7.18 | - |
| 2.6.0 | 2.6.31 | - |
| 2.5.0 | 2.5.45 | - |
| 0 | 2.3.43 | - |
Fixed versions
| 2.7.18 | 2.6.31 | 2.5.45 | 2.3.43 |
Sources
- osv: GHSA-3gx8-q682-38mx
- https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-3gx8-q682-38mx
- https://nvd.nist.gov/vuln/detail/CVE-2026-42206
- https://github.com/roadiz/core-bundle-dev-app
CVE-2026-42206 · published · modified · JSON