CVE-2025-66001High· 8.8▾ TwilightNeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/neuvector/neuvector >= 5.3.0, < 5.4.8Patched in:
github.com/neuvector/neuvector 5.4.8Connected by shared product, vendor, weakness, or advisory.
CVE-2023-32188CriticalJWT token compromise can allow malicious actions including Remote Code Execution (RCE)
CVE-2026-78425High· 7.6Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SS…
CVE-2026-78427Medium· 4.3The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images
CVE-2025-67860Low· 3.8NeuVector scanner insecurely handles passwords as command arguments
CVE-2025-14022High· 7.7LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK
CVE-2021-20327Medium· 6.4A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate