CVE-2021-26715 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting MITREid Connect through version 1.3.3, stemming from unsafe handling of the logo_uri parameter during Dynamic Client Registration. This allows unauthenticated attackers to force the vulnerable server to make HTTP requests to internal network addresses, potentially leading to data exfiltration, network boundary bypasses, or attacks on other internal hosts. With a CVSS score of 9.1 (CRITICAL) and low attack complexity, the potential impact is high confidentiality and integrity compromise. While no active exploitation, public exploits, or significant community discussion have been observed, the vulnerability remains a significant risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.3.3CPE matchmatch criteria | cpe:2.3:a:mitreid:connect:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.