CVE-2026-113373 in Nexus Repository
Summary
by MITRE • 11/04/2026
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account, and then receives a new session with the roles of that account. The attacker needs no Nexus Repository session and no Nexus Repository privilege. The attacker needs a named account that holds valid credentials at the identity provider. The anonymous user is not part of this attack path.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability in Sonatype Nexus Repository 3 Pro represents a critical authentication bypass flaw rooted in the failure to synchronize local security states with external identity providers during the login process. Specifically, when an administrator disables or locks a local account within the Nexus Repository interface, that status is not validated against credentials presented via configured SAML or OAuth2/OpenID Connect identity providers. Consequently, if the user possesses valid authentication tokens at the external provider, they can successfully authenticate and obtain a new session with full privileges associated with their role, effectively circumventing administrative restrictions intended to revoke access. This behavior indicates that the application treats local account status as irrelevant when an external identity assertion is provided, creating a significant gap in access control enforcement.
From a technical perspective, this flaw constitutes a logic error where the authentication module fails to perform necessary state checks before issuing session tokens. The system accepts valid credentials from trusted third-party providers without verifying whether the corresponding internal user entity has been deactivated or locked by local administrators. This oversight allows attackers who have compromised external identity provider credentials for an account that was previously disabled in Nexus Repository to regain access immediately upon re-authentication through the federated protocol. The attack does not require prior knowledge of Nexus-specific passwords, nor does it demand existing active sessions within the repository system, making it particularly dangerous as it relies solely on the persistence of valid external identity provider credentials.
The operational impact of this vulnerability is severe, as it undermines the principle of least privilege and administrative control over user access. An attacker can exploit this condition to maintain persistent unauthorized access even after an administrator has attempted to revoke permissions by disabling the account. This bypasses standard incident response procedures that rely on local account deactivation to contain breaches or remove rogue users. The ability to re-enter the system with full roles associated with the compromised identity provider credentials means that sensitive repository contents, build artifacts, and configuration data remain exposed to unauthorized retrieval or modification. Furthermore, because the anonymous user is not involved in this attack path, the vulnerability specifically targets authenticated but restricted accounts, complicating detection efforts since normal login activity appears legitimate until privilege escalation occurs.
This issue aligns with CWE-287 Improper Authentication, as the system fails to correctly verify identity during authentication processes involving external providers. It also relates to CWE-613 Insufficient Session Expiration, insofar as sessions are issued without validating current account status constraints. In terms of MITRE ATT&CK framework classification, this vulnerability facilitates Account Manipulation and potentially Initial Access if an attacker leverages previously disabled accounts for re-entry into the environment. The lack of cross-provider state synchronization highlights a broader architectural weakness in how federated identity management interacts with local security policies within enterprise software applications.
Mitigation strategies must focus on enforcing strict validation of local account status prior to session creation, regardless of the authentication method used. Administrators should ensure that any integration between Nexus Repository and external identity providers includes real-time checks against internal user directories for disabled or locked states before granting access. If immediate patching is not available, organizations can implement network-level controls such as firewall rules or reverse proxy configurations to block traffic from specific IP ranges associated with compromised identities until the software update is applied. Additionally, reviewing audit logs for unusual login patterns involving previously inactive accounts may help detect exploitation attempts in real time while longer-term architectural fixes are developed by the vendor to ensure consistent state management across all authentication pathways.