CVE-2026-78428 PUBLISHED

Flaw in Nuevector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

Assigner: suse
Reserved: 24.08.2026 Published: 17.09.2026 Updated: 17.09.2026

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 8

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	go
Product	neuvector
Versions	Default: unaffected Version <5.6.1 is affected

References

https://github.com/neuvector/neuvector/security/advisories/GHSA-c6rx-pmvf-m3jx
https://bugzilla.suse.com/show_bug.cgi?id=1279937