CVE-2024-1248
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user.
Risk Assessment
The organization risks unauthorized modification of local user roles, potentially leading to privilege escalation or degradation, and consequently compromising system integrity and access to sensitive data.
Recommendation
Disable silent JIT provisioning in the federated identity provider or implement mechanisms to prevent overwriting local user roles, such as enforcing unique usernames across domains.
Related vulnerabilities
- CVE-2026-115252Critical
The Confection WordPress Cable plugin from 0.4.0 to 0.4.7 does not perform capability or nonce checks before saving its settings and writes one of them unmodified into a standalone PHP file that it then serves. This allows unauthenticated users to execute arbitrary PHP code on the server.
- CVE-2026-124585Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP devices within the web administration interface. The add_expmac function in var/html/webserver mishandles the mac argument, resulting in OS command injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-123870Critical
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When GITHUB_WEBHOOK_SECRET is unset or empty (default None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the host.
- CVE-2026-124580Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP version 1.0 B-MB3W202-210825-r11775, affecting the handle_wechat_cn_wifi function in var/html/webserver within the Weixin Auth Endpoint component. Manipulation of the extend argument results in OS command injection. The attack can be executed remotely and the exploit has been made public.
- CVE-2026-124577Critical
A weakness has been identified in Intelbras SG 2404 PoE L2+ versions 1.00.70 and 1.00.72, affecting an unknown function in the /EXCU_SHELL file within the Web Management Interface component. Manipulation can lead to improper authentication. The attack can be launched remotely and the exploit has been made publicly available.
- CVE-2026-113364Critical
Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
- CVE-2026-113363Critical
Improper input validation in the network communication processing in NEC WebSAM WinShare versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer running WinShare.
- CVE-2026-124560Critical
A vulnerability was found in D-Link DIR-878 version 1.20B05 in the GetCAPTCHAsetting function of bin/prog.cgi (HNAP Handler component). Manipulating the uid argument results in a heap-based buffer overflow. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-119506Critical
The Frontend Admin by DynamiApps plugin (acf-frontend-form-element) through version 3.30.1 contains an incorrect privilege assignment vulnerability. The flaw allows an attacker to escalate privileges within the WordPress site.
- CVE-2026-6715Critical
IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.
Original NVD description (English source)
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When these conditions are met, a malicious individual can leverage the JIT provisioning process to modify the roles of local users. The overwritten roles are limited to those defined within the federated IDP, typically granting minimal access rights unless explicitly configured otherwise by the federated IDP administrator.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS