CVE-2026-90452: Security vulnerability
Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Malcolmto a version that resolves this vulnerability.Fixed in September 2026 or later
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be positioned on the network path between the reverse proxy and the identity-provider service. This network-position requirement enables the attacker to impersonate the identity provider.
What authentication operations are affected?
The affected proxy-to-identity-provider requests are token discovery, token introspection, and credential exchange. Because the identity provider certificate is not verified for these requests, forged authentication tokens may be accepted by the deployment.
What is the security impact if exploitation succeeds?
A successful attacker can impersonate the identity provider and issue forged authentication tokens that the deployment accepts.