Sonatype Nexus Repository 3 Pro: Authentication bypass (CVE-2026-113373)

Sonatype Nexus Repository 3 Pro fails to validate the local account status of users when authenticating via SAML or OAuth2/OpenID Connect identity providers. An account that has been disabled or locked by an administrator remains able to initiate a session by authenticating against the external identity provider. Upon successful external authentication, the repository grants the user a session with all roles associated with the existing, albeit disabled, local account. This vulnerability allows an attacker possessing valid credentials for the identity provider to bypass account lockout controls.

Impact

Successful exploitation results in an unauthorized, authenticated session within Nexus Repository 3 Pro with the permissions assigned to the target account. This bypasses organizational policies intended to revoke access for terminated or suspended users.

Recommendation

• Upgrade to the latest version of Nexus Repository 3 Pro as specified in the official release notes to remediate CVE-2026-113373.
• Audit administrative logs for unusual authentication patterns for accounts previously marked as disabled or locked.
• Review SAML and OAuth2/OpenID Connect configurations for administrative users to ensure local status checks are enforced if supported by the integration.