CVE-2026-78428

HighCVSS 8.8/10Last modified Sep 28, 2026

Description

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

Metrics

CVSS 4.0 8.8/10CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-384

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 17, 2026
Last modified
Sep 28, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-784305.3A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/toolsCVE-2026-784335.9Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissiCVE-2026-784346.5A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/ControCVE-2026-784353.8A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesCVE-2026-784377.3Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from anothCVE-2026-784387.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in CVE-2026-784398.8Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2026-78446.3A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/reCVE-2026-784416.5Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.CVE-2026-784428.8Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.CVE-2026-784448.1Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.CVE-2026-784459.8Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.