CVE-2021-27582

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.

• CWE-1321

• http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.htmlExploit, Third Party Advisory
• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/commit/7eba3c12fed82388f917e8dd9b73e86e3a311e4cPatch, Third Party Advisory
• https://portswigger.net/research/hidden-oauth-attack-vectorsExploit, Third Party Advisory
• http://agrrrdog.blogspot.com/2017/03/autobinding-vulns-and-spring-mvc.htmlExploit, Third Party Advisory
• https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/commit/7eba3c12fed82388f917e8dd9b73e86e3a311e4cPatch, Third Party Advisory
• https://portswigger.net/research/hidden-oauth-attack-vectorsExploit, Third Party Advisory

Published

Feb 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27574An issue was discovered in Emote Remote Mouse through 4.0.0.…8.1
• CVE-2021-27576If was found that the NetTest web service can be used to ove…7.5
• CVE-2021-27577Incorrect handling of url fragment vulnerability of Apache T…7.5
• CVE-2021-27578Cross Site Scripting vulnerability in markdown interpreter o…6.1
• CVE-2021-27579Snow Inventory Agent through 6.7.0 on Windows uses CPUID to …7.8
• CVE-2021-27581The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows …9.8
• CVE-2021-27583In Directus 8.x through 8.8.1, an attacker can discover whet…5.3
• CVE-2021-27584When a user opens manipulated PhotoShop Document (.PSD) form…3.3
• CVE-2021-27585When a user opens manipulated Computer Graphics Metafile (.C…7.8
• CVE-2021-27586When a user opens manipulated Interchange File Format (.IFF)…7.8
• CVE-2021-27587When a user opens manipulated Jupiter Tessellation (.JT) for…7.8
• CVE-2021-27588When a user opens manipulated HPGL format files received fro…7.8