{"id":"CVE-2026-113373","kind":"vulnerability","aliases":["CVE-2026-113373"],"related":[],"title":"Nexus Repository 3 Pro: disabled or locked SSO users can sign in again (SAML, OIDC)","description":"Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.","summary":"Sonatype Nexus Repository 3 Pro does not check whether a local account is disabled or locked when that user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account an administrator disabled can sign in again with valid identity provider credentials and receive a new session with that account's roles.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nexus-repository-3-pro","fixed":["3.98.0"],"affected":">= 3.86.0, < 3.98.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["authentication-bypass","infrastructure","nexus-repository","oidc","saml","self-hosted","sonatype","sso"],"not_affected_if":["fixed-3.98.0","local-accounts-only","no-saml-or-oidc","no-sso-realm"],"how_to_check":"1. Check the Nexus Repository 3 Pro version (UI About / System information): 3.86.0 through 3.97.x is affected, 3.98.0 is fixed.\n2. Check Security > Realms for an active SAML or OAuth2/OpenID Connect realm.\n3. Check Security > Users for local accounts that are disabled or locked whose owners still have identity provider credentials.\n4. Review authentication logs for sign-ins by accounts that had been disabled or locked.","fix":"Upgrade Sonatype Nexus Repository 3 Pro to 3.98.0 or later. Afterwards review authentication logs for sign-ins by accounts that were disabled or locked. If you cannot upgrade: also disable the account (or remove its role-mapped groups) in the identity provider, or deactivate the SAML/OAuth2/OIDC realm (stops all SSO logins).","status":"open","published_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","triaged_at":"2026-11-04T20:29:57+00:00","updated_at":"2026-11-04T20:31:23+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-04T20:29:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sonatype Nexus Repository 3 Pro: disabled accounts regain access through SSO sign-in","impact":"high","summary":"Sonatype Nexus Repository 3 Pro does not check whether a local account is disabled or locked when that user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account an administrator disabled can sign in again with valid identity provider credentials and receive a new session with that account's roles.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nexus-repository","sso","saml","oidc","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Disabled user regains session with full roles of account","analyst_note":"Find the affected and fixed version ranges for Nexus Repository 3 Pro in the NVD entry or the Sonatype advisory, since the sources given do not state them.","how_to_check":"- Check whether SAML or OAuth2/OpenID Connect sign-in is configured in Nexus Repository 3 Pro under the authentication settings.\n- Check the installed Nexus Repository version in the product's About page or the `nexus-repository` package version, and compare it with the fixed versions in the vendor advisory.\n- Review whether any disabled or locked local accounts still exist in the user list.","plain_action":"","needs_analyst":true,"not_affected_if":["local-accounts-only","no-saml-or-oidc"],"who_is_affected":"Teams that run Sonatype Nexus Repository 3 Pro with SAML or OAuth2/OpenID Connect single sign-on enabled are exposed, because the flaw is in that sign-in path. Installations that use only local accounts, or that do not use these identity providers, are not on this attack path. The sources do not state which versions are affected beyond the product name.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000765,"input_tokens":4208,"output_tokens":689,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected and fixed version ranges for Nexus Repository 3 Pro in the NVD entry or the Sonatype advisory, since the sources given do not state them.","search":"'-113373':18A,21A '-2026':17A,20A '3':3A,25A,44B,100C 'account':52B,74B,94B,107C,126C,149C,161C,179C 'administr':76B,133C 'anonym':189C 'attack':163C,175C,196C 'authent':28B 'authentication-bypass':27B 'bypass':29B 'check':48B,104C 'configur':64B,116C 'connect':68B,120C 'credenti':86B,145C,183C 'cve':16A,19A 'disabl':5A,54B,77B,128C 'hold':181C 'host':38B 'ident':69B,84B,121C,143C,186C 'infrastructur':30B 'local':51B,106C 'lock':7A,56B,130C 'name':178C 'need':164C,176C 'new':90B,154C 'nexus':1A,23A,32B,42B,98C,135C,166C,171C 'nexus-repositori':31B 'nexus-repository':22A 'oauth2/openid':67B,119C 'oidc':15A,34B 'part':193C 'path':197C 'privileg':173C 'pro':4A,26A,45B,101C 'provid':70B,85B,122C,144C,187C 'receiv':88B,152C 'repositori':2A,33B,43B,99C,136C,167C,172C 'repository':24A 'role':96B,158C 'saml':14A,35B,65B,117C 'self':37B 'self-host':36B 'session':91B,155C,168C 'sign':11A,60B,79B,112C,138C 'sonatyp':39B,41B,97C 'sso':8A,40B 'status':108C 'user':9A,59B,72B,111C,124C,190C 'valid':83B,142C,182C 'whether':49B 'whose':73B,125C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Sonatype Nexus Repository 3 Pro 3.86.0 to 3.97.x with a SAML or OAuth2/OpenID Connect realm enabled. If an admin disabled or locked a user in Nexus but the user still has valid identity provider credentials, they can sign in again and get that account's roles, which can include private repository reads, publishing or admin functions. Skip it if you do not use SSO realms or already run 3.98.0 or later. The advisory names Pro only.","tier":"B","verified":{"fix":{"at":"2026-11-04T20:31:23Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1700},"products":{"at":"2026-11-04T20:31:23Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1700},"mitigations":{"at":"2026-11-04T20:31:23Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1700},"workarounds":{"at":"2026-11-04T20:31:23Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1700},"how_to_check":{"at":"2026-11-04T20:31:23Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1700},"who_affected":{"at":"2026-11-04T20:31:23Z","by":"analyst","doc":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","run_id":1700}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nexusrepository3pro"],"ptokens":["nexus","pro","repository"],"labels":["authenticationbypass","critical","infrastructure","nexusrepository","oidc","saml","selfhosted","sonatype","sso"],"campaign_type":null,"first_public_at":"2026-11-04T20:18:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"103e4ec9-0a87-450b-af77-479448ddef11","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113373","severity":null,"published_at":"2026-11-04T20:18:56+00:00","modified_at":"2026-11-04T20:18:56+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","fetched_at":"2026-11-04T20:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113373:1700","url":null,"severity":null,"published_at":"2026-11-04T20:31:23+00:00","modified_at":"2026-11-04T20:31:23+00:00","first_seen_at":"2026-11-04T20:31:23+00:00","fetched_at":"2026-11-04T20:31:23+00:00","note":"Sonatype advisory (2026-11-04) read: affected Pro 3.86.0-3.97.x, fixed 3.98.0; no exploitation known; vendor mitigations in advisory. 3.98.0 release notes do not name the CVE. No social search done."}],"documents":[{"id":70328,"url":"https://support.sonatype.com/hc/en-us/articles/56614238092947/","title":"CVE-2026-113373 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":70329,"url":"https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html","title":"Sonatype Nexus Repository 3.98.0 Release Notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}