kanidm vulnerabilities

Products

• kanidm 1

Latest kanidm CVEs

Newest publication first

1. CVE-2026-46689 Kanidm: Unauthenticated process abort via SCIM filter stack exhaustion

   Published 2026-06-10

   High·CVSS 8.7 EPSS 0.32%

   Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.