CVE-2021-26905
MEDIUM1Password SCIM Bridge < 1.6.2 - Authenticated TLS Private Key Disclosure via Log File Request
Title source: llmDescription
1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key.
References (2)
Core 2
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://app-updates.agilebits.com/product_history/SCIM
Mitigation, Vendor Advisory x_refsource_confirm
https://support.1password.com/kb/202102/
Scores
CVSS v3
6.5
EPSS
0.0102
EPSS Percentile
58.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-287
Status
published
Products (1)
1password/scim_bridge
1.0.0 - 1.6.2
Published
Feb 08, 2021
Tracked Since
Feb 18, 2026