CVE-2026-78428: Flaw in Nuevector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
Affected Software
Event History
Frequently Asked Questions
Which authentication deployments are affected?
The issue applies to Nuevector users authenticated through SAML or OpenID Connect (OIDC). The provided information does not identify other authentication methods as affected.
Does an attacker need existing Nuevector privileges to exploit this issue?
The supplied vector indicates no privileges are required, but exploitation has high attack complexity and requires user interaction. The disclosed condition involves multiple SSO login attempts occurring concurrently.
What is the security impact if exploitation succeeds?
A user can receive another user's authenticated session. The severity vector indicates high confidentiality and integrity impact, with no availability impact specified.