{"id":"CVE-2026-113373","aliases":[],"cve":{"records":[{"id":"CVE-2026-113373","source":"Sonatype","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-20T01:54:48.996Z","published":"2026-11-04T20:01:19.624Z","modified":"2026-11-09T20:57:07.768Z"}],"publishers":[{"name":"Sonatype","role":"CNA","organizationId":"103e4ec9-0a87-450b-af77-479448ddef11","modified":"2026-11-04T20:01:19.624Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T20:57:07.768Z"}],"references":[{"url":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","tags":["patch"],"source":"Sonatype"},{"url":"https://support.sonatype.com/hc/en-us/articles/56614238092947/","tags":["vendor-advisory"],"source":"Sonatype"}],"weaknesses":[{"id":"CWE-1390","description":"CWE-1390 Weak Authentication","source":"Sonatype"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T20:56:57.439042Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again","titleSource":"Sonatype","descriptionSource":"Sonatype","description":"Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.","score":9.1,"severity":"critical","published":"2026-11-04T20:01:19.624Z","modified":"2026-11-09T20:57:07.768Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Sonatype","name":"Nexus Repository 3","platforms":[],"versions":[{"version":"3.86.0","status":"affected","lessThan":"3.98.0","versionType":"semver"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.86.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.86.3:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.87.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*","cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*"],"source":"Sonatype","url":"https://www.cve.org/CVERecord?id=CVE-2026-113373"}],"remediation":[],"references":["https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","https://support.sonatype.com/hc/en-us/articles/56614238092947/"],"sources":[{"name":"CVE","id":"CVE-2026-113373","modified":"2026-11-09T20:57:07.768Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-113373"}],"assessments":[{"source":"Sonatype","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-11-09T21:05:58.280Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:10:30.655Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T12:20:30.908Z","attemptedAt":"2026-11-05T12:20:30.908Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-05T12:25:31.920Z","attemptedAt":"2026-11-05T12:25:31.920Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-05T12:25:31.669Z","attemptedAt":"2026-11-05T12:25:31.669Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T12:20:30.908Z","attemptedAt":"2026-11-05T12:20:30.908Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-113373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113373","modified":"2026-11-04T20:18:56.750","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-05T12:20:30.908Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117058","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117058","modified":"Nov 4, 2026, 8:01:19 PM","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-05T12:25:31.669Z"},{"source":"GitHub Advisory Database","id":"GHSA-wcg2-hr8x-qqgg","url":"https://github.com/advisories/GHSA-wcg2-hr8x-qqgg","modified":"2026-11-04T21:32:28Z","checkedAt":"2026-11-05T12:25:31.920Z"}],"aiSummary":{"text":"Nexus Repository 3 versions before 3.98.0 allow disabled or locked users to sign in through SAML or OAuth2/OpenID Connect with valid identity provider credentials, receiving a new session with their roles. The attacker needs a named account with valid credentials at the identity provider.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T20:56:05.607Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-113373"}]}}