Hhimmelblau-idm

Products

Exploited and recent CVEs

• CVE-2026-45108 High 8.4 Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow 0.2%
• CVE-2026-34397 Medium 6.3 himmelblau: NSS fake-primary group lookup reintroduces name collision risk 0.2%
• CVE-2026-31979 High 8.8 himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache 0.2%
• CVE-2026-31957 Critical 10.0 Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments 0.6%
• CVE-2025-59044 Medium 4.4 Himmelblau vulnerable to GID collision via group name-derived mapping (privilege escalation) 0.1%
• CVE-2025-54882 High 7.1 Himmelblau's Kerberos credential cache collection is world readable 0.2%
• CVE-2025-54781 Low 2.8 Himmelblau leaks an Intune service access token in its logs 0.2%
• CVE-2025-53013 Medium 5.2 Himmelblau offline auth permits authentication with invalid Hello PIN 0.2%
• CVE-2025-49012 Medium 5.4 Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass 0.4%
• CVE-2025-24034 Low 3.2 Himmelblau leaks credentials in the debug log 0.2%