NEXUS-REPOSITORY-3-PRO · CVE-2026-113373 · Infrastructure
FIX → 3.98.0 ✓ verified
Sonatype Nexus Repository 3 Pro does not check whether a local account is disabled or locked when that user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account an administrator disabled can sign in again with valid identity provider credentials and receive a new session with that account's roles.
first public Nov 4, 2026 · 2 sources
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Self-hosted Sonatype Nexus Repository 3 Pro 3.86.0 to 3.97.x with a SAML or OAuth2/OpenID Connect realm enabled. If an admin disabled or locked a user in Nexus but the user still has valid identity provider credentials, they can sign in again and get that account's roles, which can include private repository reads, publishing or admin functions. Skip it if you do not use SSO realms or already run 3.98.0 or later. The advisory names Pro only.
Not affected if fixed-3.98.0, local-accounts-only, no-saml-or-oidc, no-sso-realm
Who cares authentication-bypass, nexus-repository, oidc, saml, self-hosted, sonatype, sso
Upgrade to 3.98.0
3.98.0 or laterSonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
This page as .md · .json · in your agent: get_signal("CVE-2026-113373") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.