CVE-2026-113373: Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue applies to Sonatype Nexus Repository 3 Pro deployments that have SAML or OAuth2/OpenID Connect identity-provider authentication configured. The attack path does not involve anonymous access.
What does an attacker need to exploit it?
The attacker needs a named Nexus Repository account that has been disabled or locked, plus valid credentials for the configured identity provider that map to that account. They do not need an existing Nexus Repository session or any Nexus Repository privilege.
What access could be regained through exploitation?
A successful sign-in creates a new session for the disabled or locked account and grants the roles assigned to that account. The resulting access is therefore determined by that account's existing Nexus Repository roles.