CVE-2026-88819
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.3
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.12%
- CWE
- CWE-290, CWE-345
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- Eclipse Foundation Eclipse Data Plane Core
- Eclipse Foundation Eclipse Data Plane Core
Weakness type
Related vulnerabilities
- CVE-2026-25938 — FUXA Unauthenticated Remote Code Execution in Node-RED Integration
- CVE-2026-27478 — Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation
- CVE-2025-11250 — Authentication Bypass
- CVE-2026-33654 — Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
- CVE-2026-31889 — Shopware has a potential take over of app credentials
- CVE-2026-33661 — WeChat Pay callback signature verification bypassed when Host header is localhost
- CVE-2026-76423 — Cisco ISE API Authentication Bypass Vulnerability
- CVE-2026-6213 — Remote Spark SparkView RCE