CVE-2021-26715

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.

• CWE-918

• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releasesThird Party Advisory
• https://portswigger.net/research/hidden-oauth-attack-vectorsExploit, Third Party Advisory
• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/releasesThird Party Advisory
• https://portswigger.net/research/hidden-oauth-attack-vectorsExploit, Third Party Advisory

Published

Mar 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26709D-Link DSL-320B-D1 devices through EU_1.25 are prone to mult…9.8
• CVE-2021-26710A cross-site scripting (XSS) issue in the login panel in Red…6.1
• CVE-2021-26711A frame-injection issue in the online help in Redwood Report…5.3
• CVE-2021-26712Incorrect access controls in res_srtp.c in Sangoma Asterisk …7.5
• CVE-2021-26713A stack-based buffer overflow in res_rtp_asterisk.c in Sango…6.5
• CVE-2021-26714The Enterprise License Manager portal in Mitel MiContact Cen…9.8
• CVE-2021-26716Modules/input/Views/schedule.php in Emoncms through 10.2.7 a…6.1
• CVE-2021-26717An issue was discovered in Sangoma Asterisk 16.x before 16.1…7.5
• CVE-2021-26718KIS for macOS in some use cases was vulnerable to AV bypass …5.5
• CVE-2021-26719A directory traversal issue was discovered in Gradle gradle-…6.5
• CVE-2021-26720avahi-daemon-check-dns.sh in the Debian avahi package throug…7.8
• CVE-2021-26722LinkedIn Oncall through 1.4.0 allows reflected XSS via /quer…6.1