CVE-2026-3277CWE-312

The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the…

Medium · published February 27, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

The OpenID Connect (OIDC) authentication configuration in PowerShell

Universal before 2026.1.3 stores the OIDC client secret in cleartext in

the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00221 · 12.0th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-02-27T15:11Z
EPSS history
Timeline
  • 27 FEB 15:11Z
    The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the…
    cvelistv5