---
id: "CVE-2026-113373"
kind: "vulnerability"
aliases: ["CVE-2026-113373"]
title: "Nexus Repository 3 Pro: disabled or locked SSO users can sign in again (SAML, OIDC)"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "nexus-repository-3-pro", "fixed": ["3.98.0"], "affected": ">= 3.86.0, < 3.98.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authentication-bypass", "infrastructure", "nexus-repository", "oidc", "saml", "self-hosted", "sonatype", "sso"]
not_affected_if: ["fixed-3.98.0", "local-accounts-only", "no-saml-or-oidc", "no-sso-realm"]
published_at: "2026-11-04T20:18:56+00:00"
first_seen_at: "2026-11-04T20:29:02+00:00"
updated_at: "2026-11-04T20:31:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113373", "first_seen_at": "2026-11-04T20:29:02+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T20:31:23+00:00"}]
---

# Nexus Repository 3 Pro: disabled or locked SSO users can sign in again (SAML, OIDC)

Sonatype Nexus Repository 3 Pro does not check whether a local account is disabled or locked when that user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account an administrator disabled can sign in again with valid identity provider credentials and receive a new session with that account's roles.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:nexus-repository-3-pro affected >= 3.86.0, < 3.98.0 fixed 3.98.0

## How to check

1. Check the Nexus Repository 3 Pro version (UI About / System information): 3.86.0 through 3.97.x is affected, 3.98.0 is fixed.
2. Check Security > Realms for an active SAML or OAuth2/OpenID Connect realm.
3. Check Security > Users for local accounts that are disabled or locked whose owners still have identity provider credentials.
4. Review authentication logs for sign-ins by accounts that had been disabled or locked.

## Fix

Upgrade Sonatype Nexus Repository 3 Pro to 3.98.0 or later. Afterwards review authentication logs for sign-ins by accounts that were disabled or locked. If you cannot upgrade: also disable the account (or remove its role-mapped groups) in the identity provider, or deactivate the SAML/OAuth2/OIDC realm (stops all SSO logins).

## Timeline

- 2026-11-04T20:29:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113373
- 2026-11-04T20:31:23+00:00 analyst — Sonatype advisory (2026-11-04) read: affected Pro 3.86.0-3.97.x, fixed 3.98.0; no exploitation known; vendor mitigations in advisory. 3.98.0 release notes do not name the CVE. No social search done.

## Documents

- [advisory] CVE-2026-113373 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again https://support.sonatype.com/hc/en-us/articles/56614238092947/
- [fix] Sonatype Nexus Repository 3.98.0 Release Notes https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html

## From the sources

Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_