CVE-2026-113373
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in…
- Risk score
- 60/100
- CVSS
- 9.1 v4.0
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 9.1 critical
- Remotely exploitable without logging in
References
Original description
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
Last activity 4 Nov 2026. Patch Forecast updates every hour.