Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-26715

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-26715
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:41 UTC · Revision 1

Source evidence

CVE-2021-26715

core-osv · Original source

Published 25 Mar 2021, 09:15 UTC

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.

osv:CVE-2021-26715
Complete source record
{
  "id": "fc947cd10224773ac3e02af1669a583d3cce31623f89b95b63e3b24580c75dae",
  "url": "https://osv.dev/vulnerability/CVE-2021-26715",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-26715",
    "summary": "The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.",
    "evidence": "osv:CVE-2021-26715",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2021-26715",
      "aliases": [
        "CVE-2021-26715",
        "GHSA-792r-mh2q-p8qp"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/mitreid-connect/openid-connect-java-spring-server",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "73459f0348135013952146196d94e0d065f62739"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:mitreid:connect:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.3.3"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "mitreid-connect-1.3.3",
            "mitreid-connect-1.3.2",
            "mitreid-connect-1.3.1",
            "mitreid-connect-1.3.0",
            "mitreid-connect-1.3.0-RC2",
            "mitreid-connect-1.3.0-RC1",
            "mitreid-connect-1.2.6",
            "mitreid-connect-1.2.5",
            "mitreid-connect-1.2.4",
            "mitreid-connect-1.2.3",
            "mitreid-connect-1.2.2",
            "mitreid-connect-1.2.1",
            "mitreid-connect-1.2.0",
            "mitreid-connect-1.2.0-RC2",
            "mitreid-connect-1.2.0-RC1",
            "mitreid-connect-1.1.9",
            "mitreid-connect-1.1.8",
            "mitreid-connect-1.1.7",
            "mitreid-connect-1.1.6",
            "mitreid-connect-1.1.5",
            "mitreid-connect-1.1.4",
            "mitreid-connect-1.1.3",
            "mitreid-connect-1.1.2",
            "mitreid-connect-1.1.1",
            "mitreid-connect-1.1.0",
            "iss294-0.9",
            "iss294-start",
            "M2-pre-data-model-changes",
            "M-3",
            "M-2",
            "M-1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26715.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:34.501705911Z",
      "provider": "osv",
      "references": [
        "https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releases",
        "https://portswigger.net/research/hidden-oauth-attack-vectors"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-26715",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385622,
  "published_at": "2021-03-25T09:15:12.633+00:00"
}