Skip to contentHimmelblau-idm Himmelblau vulnerabilities
- himmelblau-idm himmelblauHimmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) FlowCVE-2026-45108Fix available8.4 High
- himmelblau-idm himmelblauhimmelblau: NSS fake-primary group lookup reintroduces name collision riskCVE-2026-34397Fix available6.3 Medium
- himmelblau-idm himmelblauhimmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccacheCVE-2026-31979Fix available8.8 High
- himmelblau-idm himmelblauHimmelblau unset domain configuration can allow any-tenant authentication at first login for remote deploymentsCVE-2026-3195710.0 Critical
- himmelblau-idm himmelblauHimmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation)CVE-2025-590444.4 Medium
- himmelblau-idm himmelblauHimmelblau's Kerberos credential cache collection is world readableCVE-2025-54882Fix available7.1 High
- himmelblau-idm himmelblauHimmelblau leaks an Intune service access token in its logsCVE-2025-547812.8 Low
- himmelblau-idm himmelblauHimmelblau offline auth permits authentication with invalid Hello PINCVE-2025-53013Fix available5.2 Medium
- himmelblau-idm himmelblauHimmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security BypassCVE-2025-490125.4 Medium
- himmelblau-idm himmelblauHimmelblau leaks credentials in the debug logCVE-2025-240343.2 Low