CVE-2026-45795

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null, and AuthzRequestService.processRequestObject() does not reject the unrecognized RSA-OAEP algorithm when forceSignedRequestObject=true. This issue is fixed in version 2.0.0.

• CWE-347

• https://github.com/JanssenProject/jans/commit/0cdd214870ee30eb2186261f21c85b9e9fc63b5c
• https://github.com/JanssenProject/jans/pull/13438
• https://github.com/JanssenProject/jans/releases/tag/v2.0.0
• https://github.com/JanssenProject/jans/security/advisories/GHSA-r3gj-4pj2-9j3j
• https://github.com/JanssenProject/jans/security/advisories/GHSA-r3gj-4pj2-9j3j

Published

Jul 16, 2026

Last Modified

Jul 16, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45785OpenMcdf is a fully .NET / C# library to manipulate Compound…6.2
• CVE-2026-45787electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…9.1
• CVE-2026-45788Discourse is an open-source discussion platform. Prior to 20…7.5
• CVE-2026-4579A vulnerability was identified in code-projects Simple Laund…9.8
• CVE-2026-45792rtk filters and compresses command outputs before they reach…5.5
• CVE-2026-45793Composer is a dependency Manager for the PHP language. Prior…7.5
• CVE-2026-45796Coder allows organizations to provision remote development e…6.5
• CVE-2026-45797HeyForm is an open-source form builder. Prior to version 3.0…6.4
• CVE-2026-45799Wire provides gRPC and protocol buffers for Android, Kotlin,…7.5
• CVE-2026-4580A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-45800Vvveb is a powerful and easy to use CMS with page builder to…8.7
• CVE-2026-45802FPDI is a collection of PHP classes that facilitate reading …6