{"id":"CVE-2026-101152","published":"2026-10-06T20:17:09.243","lastModified":"2026-10-07T13:38:48.657","description":"Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-601"],"vendors":[],"products":[],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24803-security-advisory-0187","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A flaw in the SSO login flow allows attackers to redirect authentication responses to attacker-controlled URLs instead of CloudVision, potentially enabling unauthorized access to user accounts. This represents a significant risk to identity provider security.","exploitability":"Exploitation requires crafting a malicious URL and tricking a user into clicking it, making it moderately difficult but achievable through social engineering with no privileged access requirements.","blast_radius":"If exploited, attackers could gain access to user accounts across the CloudVision platform, potentially compromising sensitive network management data and operations.","remediation":"Disable SSO login functionality until a patched version is available, or implement strict URL validation for all SSO redirect endpoints.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sso","auth-bypass","identity-provider"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:59:53.515Z"}}