MinorCritical vulnerability

CVE-2026-101152 (CVSS 7.6)

NVD · officialPublished Oct 6, 2026Risk 23/100

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.

Technical details

CVSS

7.6

AV:NetworkAC:HighPR:NoneUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source