CVE-2021-27582: Mitreid Connect

Critical severity, CVSS 9.1. EPSS: 2.2% chance of exploitation in the next 30 days.

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.

Affected products

• Mitreid Connect: up to and including 1.3.3

Published 2021-02-23. Last modified 2026-06-17.