Threats tagged 'ghsa-m6c4-53vv-535v'

Apache Roller versions 5.1.0 through 6.1.6 contain an improper authentication vulnerability in the OpenID sign-in process. This flaw allows users whose accounts have been disabled by an administrator to sign in again via OpenID and access unpublished entries. The issue affects only sites that have enabled the non-default OpenID authentication mode. Apache Roller 6.1.7 and later versions have removed OpenID 2.0, mitigating this vulnerability.