smart-sso vulnerabilities

CVEs whose affected-version data names the smart-sso package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111622Medium· 6.8PoC

yesterday

smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted…

▾ Twilighta466350665 · smart-ssovia CVEORG