CVE-2026-113373
Received Received - Intake

Nexus Repository Pro SAML OAuth2 Session Bypass

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Sonatype

Description
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-113373
EUVD
EUVD-2026-117058

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sonatype Nexus Repository 3 3.86.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1390 The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Sonatype Nexus Repository 3 Pro allows disabled or locked user accounts to regain access by signing in through a configured SAML or OAuth2/OpenID Connect identity provider. The system fails to check the local account status during login, enabling attackers with valid identity provider credentials to bypass Nexus Repository's session or privilege checks and receive a new session with the account's original roles.

Detection Guidance

Check Nexus Repository logs for successful logins from accounts that should be disabled or locked. Review SAML/OAuth2/OpenID Connect realm configurations for unauthorized access attempts. Verify user sessions against disabled accounts in the identity provider.

Impact Analysis

An attacker could gain unauthorized access to private repositories, publish malicious components, or perform administrative functions if the compromised account has sufficient privileges. The attack requires only valid identity provider credentials and no prior Nexus Repository access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control. Organizations using Nexus Repository for regulated environments may face audit failures or legal penalties due to insufficient access controls.

Mitigation Strategies
  • Upgrade to Sonatype Nexus Repository 3.98.0 or later immediately.
  • Disable affected accounts in the identity provider (SAML/OAuth2/OpenID Connect).
  • Deactivate the SAML/OAuth2/OpenID Connect realm until the upgrade is completed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...