CWE-694
AllowedUse of Multiple Resources with Duplicate Identifier
Abstraction: Base · Status: Incomplete
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
26 vulnerabilities reference this CWE, most recent first.
GHSA-H63V-VVGJ-VRFH
Vulnerability from github – Published: 2026-10-11 15:31 – Updated: 2026-10-11 15:31JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
{
"affected": [],
"aliases": [
"CVE-2026-108752"
],
"database_specific": {
"cwe_ids": [
"CWE-694"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-11T13:17:20Z",
"severity": "LOW"
},
"details": "JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user\u0027s named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice\u0027s server prod, breaking OAuth login and revoking tokens by stopping their own server.",
"id": "GHSA-h63v-vvgj-vrfh",
"modified": "2026-10-11T15:31:05Z",
"published": "2026-10-11T15:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108752"
},
{
"type": "WEB",
"url": "https://github.com/jupyterhub/jupyterhub"
},
{
"type": "WEB",
"url": "https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/oauth/provider.py#L719-L754"
},
{
"type": "WEB",
"url": "https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L1174-L1186"
},
{
"type": "WEB",
"url": "https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L563-L567"
},
{
"type": "WEB",
"url": "https://hackmd.io/@haind/jupyterhub-oauth-client-id-cross-user-collision"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jupyterhub-through-6.0.1-oauth-client-id-collision-via-unescaped-hyphen"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JM56-5H66-W453
Vulnerability from github – Published: 2021-05-24 16:57 – Updated: 2023-10-02 13:35Impact
During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository.
To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection).
Specific Go Packages Affected
helm.sh/helm/v3/pkg/repo
Patches
This issue has been patched in Helm 3.3.2 and 2.16.11
Workarounds
- do not install charts from repositories you do not trust
- fetch charts using a secure channel of communication (such as TLS)
- use
helm pullto fetch the chart, then review the chart’s content (either manually, or withhelm verifyif it has been signed) to ensure it has not been tampered with - manually review the index file in the Helm repository cache before installing software.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "helm.sh/helm/v3"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.3.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "helm.sh/helm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-15185"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-694",
"CWE-74"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-24T16:47:58Z",
"nvd_published_at": "2020-09-17T22:15:00Z",
"severity": "LOW"
},
"details": "### Impact\n\nDuring a security audit of Helm\u0027s code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository.\n\nTo perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection).\n\n### Specific Go Packages Affected\nhelm.sh/helm/v3/pkg/repo\n\n### Patches\n\nThis issue has been patched in Helm 3.3.2 and 2.16.11\n\n### Workarounds\n\n- do not install charts from repositories you do not trust\n- fetch charts using a secure channel of communication (such as TLS)\n- use `helm pull` to fetch the chart, then review the chart\u2019s content (either manually, or with `helm verify` if it has been signed) to ensure it has not been tampered with\n- manually review the index file in the Helm repository cache before installing software.",
"id": "GHSA-jm56-5h66-w453",
"modified": "2023-10-02T13:35:50Z",
"published": "2021-05-24T16:57:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15185"
},
{
"type": "WEB",
"url": "https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc"
},
{
"type": "WEB",
"url": "https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Repository index file allows for duplicates of the same chart entry in helm"
}
GHSA-JP7H-4F3C-9RC7
Vulnerability from github – Published: 2025-10-23 16:01 – Updated: 2025-10-23 16:01Impact
This is a cross-account impersonation vulnerability in the auth-aws plugin. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access.
This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts.
The core of the vulnerability is a flawed caching mechanism that fails to validate the AWS Account ID during authentication. While the use of wildcards in a bound_iam_principal_arn configuration significantly increases the attack surface, wildcards are not a prerequisite for exploitation. The vulnerability can be exploited with specific ARN bindings if a role name collision occurs.
Successful exploitation can lead to unauthorized access to secrets, data exfiltration, and privilege escalation. Given that the only prerequisite is a duplicate role name, the severity is considered high.
Patches
This vulnerability has been patched in version 0.1.1 of the auth-aws plugin.
Users are advised to upgrade to version 0.1.1 or later to remediate this vulnerability.
Workarounds
For users who are unable to upgrade to version 0.1.1 immediately, the most effective workaround is to guarantee that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment. This is the most critical mitigation step.
Primary Mitigation: Audit your AWS organizations to identify and rename any duplicate IAM role names. Enforce a naming convention that includes account-specific identifiers to prevent future collisions.
While removing wildcards from your bound_iam_principal_arn configuration is still recommended as a security best practice, it will not mitigate this vulnerability if duplicate role names exist.
Credits
This vulnerability was discovered and reported by Pavlos Karakalidis
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.1.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/openbao/openbao-plugins"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59048"
],
"database_specific": {
"cwe_ids": [
"CWE-694",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-23T16:01:27Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nThis is a cross-account impersonation vulnerability in the `auth-aws` plugin. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the **same name** in a trusted account, leading to unauthorized access.\n\nThis impacts all users of the `auth-aws` plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts.\n\nThe core of the vulnerability is a flawed caching mechanism that fails to validate the AWS Account ID during authentication. While the use of wildcards in a `bound_iam_principal_arn configuration` significantly increases the attack surface, **wildcards are not a prerequisite for exploitation**. The vulnerability can be exploited with specific ARN bindings if a role name collision occurs.\n\nSuccessful exploitation can lead to unauthorized access to secrets, data exfiltration, and privilege escalation. Given that the only prerequisite is a duplicate role name, the severity is considered **high**.\n\n### Patches\nThis vulnerability has been patched in version **0.1.1** of the `auth-aws` plugin.\nUsers are advised to upgrade to version **0.1.1** or later to remediate this vulnerability.\n\n### Workarounds\nFor users who are unable to upgrade to version **0.1.1** immediately, the most effective workaround is to **guarantee that IAM role names are unique across all AWS accounts** that could potentially interact with your OpenBao environment. This is the most critical mitigation step.\n\n**Primary Mitigation**: Audit your AWS organizations to identify and rename any duplicate IAM role names. Enforce a naming convention that includes account-specific identifiers to prevent future collisions.\n\nWhile removing wildcards from your `bound_iam_principal_arn` configuration is still recommended as a security best practice, it **will not** mitigate this vulnerability if duplicate role names exist.\n\n### Credits\nThis vulnerability was discovered and reported by [Pavlos Karakalidis](https://github.com/pkarakal/)",
"id": "GHSA-jp7h-4f3c-9rc7",
"modified": "2025-10-23T16:01:27Z",
"published": "2025-10-23T16:01:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openbao/openbao-plugins/security/advisories/GHSA-jp7h-4f3c-9rc7"
},
{
"type": "WEB",
"url": "https://github.com/openbao/openbao-plugins/commit/2a77af36834746ca6d3ac9bd1049154c84b3efae"
},
{
"type": "PACKAGE",
"url": "https://github.com/openbao/openbao-plugins"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method"
}
GHSA-M4XF-X7W2-QGFQ
Vulnerability from github – Published: 2026-07-10 00:31 – Updated: 2026-07-10 00:31A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
On an MX with SPC3 and SRX devices configured for VPN service, when a large number of VPN negotiations fail a peer index rollover will eventually occur. As a result, new peers are assigned index values that are already in use and the iked process starts to crash repeatedly. This results in failure to establish new VPN connections and rekeying existing ones. To restore service the system must be rebooted. Please note that the index value can't be monitored, so customers should monitor tunnel up and down events and if a lot of events occur over an extended period of time it becomes likely that this issue occurs.
To be exposed to this issue the system needs to run iked (vs. kmd which is not affected), which can be verified with:
user@host> show system processes extensive | match "KMD|IKED" This issue affects Junos OS on MX with SPC3, SRX Series:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S6,
- 24.2 versions before 24.2R2-S3,
- 24.4 versions before 24.4R2-S4,
- 25.2 versions before 25.2R1-S1.
{
"affected": [],
"aliases": [
"CVE-2026-57024"
],
"database_specific": {
"cwe_ids": [
"CWE-694"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-09T22:17:07Z",
"severity": "MODERATE"
},
"details": "A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\n\n\nOn an MX with SPC3 and SRX devices configured for VPN service, when a large number of VPN negotiations fail\u00a0a peer index rollover will eventually occur. As a result, new peers are assigned index values that are already in use and the iked process starts to crash repeatedly. This results in failure to establish new VPN connections and rekeying existing ones. To restore service the system must be rebooted.\nPlease note that the index value can\u0027t be monitored, so customers should monitor tunnel up and down events and if a lot of events occur over an extended period of time it becomes likely that this issue occurs.\n\nTo be exposed to this issue the system needs to run iked (vs. kmd which is not affected), which can be verified with:\n\nuser@host\u003e show system processes extensive | match \"KMD|IKED\"\nThis issue affects Junos OS on MX with SPC3, SRX Series:\n\n\n * all versions before 23.2R2-S7,\n * 23.4 versions before 23.4R2-S6,\n * 24.2 versions before 24.2R2-S3,\n * 24.4 versions before 24.4R2-S4,\n * 25.2 versions before 25.2R1-S1.",
"id": "GHSA-m4xf-x7w2-qgfq",
"modified": "2026-07-10T00:31:26Z",
"published": "2026-07-10T00:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57024"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA110084"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MJGP-HGFR-77JQ
Vulnerability from github – Published: 2026-09-29 18:31 – Updated: 2026-09-29 18:31SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.
{
"affected": [],
"aliases": [
"CVE-2026-102634"
],
"database_specific": {
"cwe_ids": [
"CWE-694"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-29T17:17:07Z",
"severity": "HIGH"
},
"details": "SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users\u0027 requests until transfer timeout.",
"id": "GHSA-mjgp-hgfr-77jq",
"modified": "2026-09-29T18:31:50Z",
"published": "2026-09-29T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102634"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/issues/40125"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/common/conn.py#L392-L393"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/decode.py#L942"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/disaggregation/mooncake/conn.py#L2760-L2764"
},
{
"type": "WEB",
"url": "https://github.com/sgl-project/sglang/blob/v0.5.20/python/sglang/srt/managers/io_struct.py#L281"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.20-denial-of-service-via-duplicate-bootstrap-room"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XH5W-G8GQ-R3V9
Vulnerability from github – Published: 2025-11-24 18:31 – Updated: 2026-05-29 20:50A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keylime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.13.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-13609"
],
"database_specific": {
"cwe_ids": [
"CWE-694"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-26T19:32:37Z",
"nvd_published_at": "2025-11-24T18:15:49Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent\u0027s unique identifier (UUID). This action overwrites the legitimate agent\u0027s identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.",
"id": "GHSA-xh5w-g8gq-r3v9",
"modified": "2026-05-29T20:50:19Z",
"published": "2025-11-24T18:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13609"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/issues/1820"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/pull/1785"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/commit/e1ae8de1f7b1385eaeec66572a92ff1338e6e157"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23201"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23210"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23628"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23735"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:23852"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:0429"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-13609"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416761"
},
{
"type": "PACKAGE",
"url": "https://github.com/keylime/keylime"
},
{
"type": "WEB",
"url": "https://github.com/keylime/keylime/releases/tag/v7.13.0"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/keylime/PYSEC-2025-77.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices"
}
Mitigation
Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.
No CAPEC attack patterns related to this CWE.