CVE-2021-23365

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Apr 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-233685.3The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.CVE-2021-233699.8The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templaCVE-2021-23377.2Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c.CVE-2021-233709.8This affects the package swiper before 6.5.1.CVE-2021-233717.5This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.CVE-2021-233727.5All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandlCVE-2021-233739.8All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.CVE-2021-233749.8This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attaCVE-2021-233759.8This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attackerCVE-2021-233769.8This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for aCVE-2021-233779.8This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for anCVE-2021-233789.8This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker