8.8
High
CVE-2025-66001 NeuVector supports login authentication through OpenID Connect
Description
NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) for OpenID Connect is not enforced by default. As a result this may expose the system to man-in-the-middle (MITM) attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| neuvector 5.3 | 5.3.0 → < 5.4.8 | 5.4.8 |
References
- bugzilla.suse.com bugzilla.suse.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of neuvector
The 14 CVEs of neuvector →
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)…
8.8
High
CVE-2026-78426
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field
2.0
Low
CVE-2026-78428
For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving…
8.8
High
CVE-2025-46808
An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive…
6.8
Medium