Threats affecting pkg:github/siemens/linux-entra-sso

CVE-2026-42177 is an improper access control vulnerability in the Siemens linux-entra-sso browser plugin for Linux versions prior to 1.8.1. The vulnerability arises because the Chrome adapter registers a broad URL matching rule that attaches the Entra ID Primary Refresh Token (PRT) cookie to requests matching a substring pattern, without properly restricting the URL scope. This can cause the PRT cookie to be sent to attacker-controlled hosts if the URL path embeds the legitimate login URL, potentially exposing sensitive authentication tokens. The issue is fixed in version 1.8.1.