AIKIDO-2026-10366

TL;DR

Affected versions of this package are affected by an access control bypass vulnerability in the authentication flow with external Identity Providers. If a user successfully authenticates with the Identity Provider but is subsequently denied access to the application due to custom code or a server error, the session at the Identity Provider may remain active. As a result, subsequent authentication attempts from the same environment may automatically succeed without requiring the user to reauthenticate, potentially leading to unintended access in shared computing environments.