CVE-2026-90452

Received Received - Intake

Reverse Proxy Identity Provider Certificate Validation Bypass

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90452

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability involves a reverse proxy not verifying the identity provider's server certificate during token discovery, introspection, or credential exchange. An attacker on the network path could impersonate the identity provider and forge authentication tokens accepted by the system.

Detection Guidance

This vulnerability involves a reverse proxy not verifying the identity provider's server certificate, allowing network attackers to impersonate the provider. Detection requires checking if TLS certificate validation is disabled or misconfigured between the proxy and identity provider. Inspect proxy and identity provider logs for certificate errors or warnings. Use network monitoring tools to verify TLS handshake integrity.

Impact Analysis

An attacker could gain unauthorized access to systems or data by forging authentication tokens. This could lead to data breaches, unauthorized transactions, or other malicious activities depending on the system's use of these tokens.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Configure the reverse proxy to verify the identity provider's server certificate during token discovery, introspection, and credential exchange. Ensure TLS certificate validation is enforced for all connections to the identity provider.

Hi! I’m here to help you understand CVE-2026-90452. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70