Security: JanssenProject/jans
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
SSRF in RedirectionUriService (sector_identifier_uri / DCR) (conditional on DCR being enabled)GHSA-9qw4-gwgf-3q27 published
Jul 10, 2026 by moabuHigh -
Reflected XSS (JavaScript context) in EndSessionUtilsGHSA-vxgw-mxhf-2m6f published
Jul 10, 2026 by moabuCritical -
SSRF in AuthorizeAction.getRequestedClaims (request_uri)GHSA-8gmm-83qv-w67g published
Jul 10, 2026 by moabuModerate -
JWE Request Object Signature Verification Bypass in jans-auth-serverGHSA-r3gj-4pj2-9j3j published
May 13, 2026 by moabuModerate -
Jans CLI storing password in plaintext in the local cli_cmd.log fileGHSA-2f4x-m695-jvp3 published
Aug 5, 2025 by moabuModerate -
Janssen Config API returns results without scope verificationGHSA-373j-mhpf-84wg published
Jun 30, 2025 by moabuCritical