gitsafehub
github.com/olamy/openid4java ↗

olamy/openid4java

scanned 2026-08-11 · git cde43bf
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets11Vulnerable dependencies48Known OSS vulnerabilities59Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 11 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/consumer/ConsumerManagerTest.java:74
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/AssociationTestData.xml:4
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/AssociationTestData.xml:12
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:12
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:13
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:23
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:24
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:36
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:37
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:47
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    test/src/org/openid4java/association/DiffieHellmanSessionTestData.xml:48
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 48 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2015-7501 apache-commons-collections: InvokerTransformer code execution during deserialisation
    pom.xml
    A package you depend on has a known security hole (CVE-2015-7501). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-2976 guava: insecure temporary directory creation
    pom.xml
    A package you depend on has a known security hole (CVE-2023-2976). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-6420 Insecure Deserialization in Apache Commons Collection
    pom.xml
    A package you depend on has a known security hole (CVE-2015-6420). Fix: Update that package to its patched version.
  • Worth fixing CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
    pom.xml
    A package you depend on has a known security hole (CVE-2012-5783). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
    pom.xml
    A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
  • Worth fixing CVE-2012-6153 CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2012-6153). Fix: Update that package to its patched version.
  • Worth fixing CVE-2011-1498 Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used ...
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2011-1498). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-3577 CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2014-3577). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-5262 httpcomponents-core: missing HTTPS connection timeout
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2015-5262). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-13956 apache-httpclient: incorrect handling of malformed authority component in request URIs
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2020-13956). Fix: Update that package to its patched version.
  • Worth fixing CVE-2012-0881 xml: xerces-j2 hash table collisions CPU usage DoS (oCERT-2011-003)
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2012-0881). Fix: Update that package to its patched version.
  • Worth fixing CVE-2013-4002 OpenJDK: XML parsing Denial of Service (JAXP, 8017298)
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2013-4002). Fix: Update that package to its patched version.
  • Worth fixing CVE-2009-2625 JDK: XML parsing Denial-Of-Service (6845701)
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2009-2625). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-14338 wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2020-14338). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-23437 xerces-j2: infinite loop when handling specially crafted XML document payloads
    samples/consumer-servlet/pom.xml
    A package you depend on has a known security hole (CVE-2022-23437). Fix: Update that package to its patched version.
  • Worth fixing CVE-2012-5783 jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2012-5783). Fix: Update that package to its patched version.
  • Worth fixing CVE-2012-6153 CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2012-6153). Fix: Update that package to its patched version.
  • Worth fixing CVE-2011-1498 Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used ...
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2011-1498). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-3577 CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2014-3577). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-5262 httpcomponents-core: missing HTTPS connection timeout
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2015-5262). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-13956 apache-httpclient: incorrect handling of malformed authority component in request URIs
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2020-13956). Fix: Update that package to its patched version.
  • Worth fixing CVE-2012-6153 CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2012-6153). Fix: Update that package to its patched version.
  • Worth fixing CVE-2011-1498 Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used ...
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2011-1498). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-3577 CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2014-3577). Fix: Update that package to its patched version.
  • Worth fixing CVE-2015-5262 httpcomponents-core: missing HTTPS connection timeout
    samples/pom.xml
    A package you depend on has a known security hole (CVE-2015-5262). Fix: Update that package to its patched version.
… 23 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 59 found · 3 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-fjq5-5j5f-mvxh Deserialization of Untrusted Data in Apache commons collections
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2015-7501). Fix: Update that package to its patched version.
  • Serious GHSA-hwj3-m3p6-hj38 dom4j allows External Entities by default which might enable XXE attacks
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2020-10683). Fix: Update that package to its patched version.
  • Serious GHSA-36p3-wjmg-h94x Remote Code Execution in Spring Framework
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2022-22965). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2026-6790). Fix: Update that package to its patched version.
  • Worth fixing GHSA-9299-c6m4-mjhc Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2024-7708). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g8m5-722r-8whq Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2024-8184). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qw69-rqj8-6qw8 OutOfMemoryError for large multipart without filename in Eclipse Jetty
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2023-26048). Fix: Update that package to its patched version.
  • Worth fixing GHSA-j26w-f9rq-mr2q Eclipse Jetty has a denial of service vulnerability on DosFilter
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2024-9823). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7g45-4rm6-3mm3 Guava vulnerable to insecure use of temporary directory
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2023-2976). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6hgm-866r-3cjv Insecure Deserialization in Apache Commons Collection
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2015-6420). Fix: Update that package to its patched version.
  • Worth fixing GHSA-gwrp-pvrq-jmwv Path Traversal and Improper Input Validation in Apache Commons IO
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
  • Worth fixing GHSA-j288-q9x7-2f5v Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2025-48924). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6pcc-3rfx-4gpm Dom4j contains a XML Injection vulnerability
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2018-1000632). Fix: Update that package to its patched version.
  • Worth fixing GHSA-355h-qmc2-wpwf Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2026-2332). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hmr7-m48g-48f6 Jetty accepts "+" prefixed value in Content-Length
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2023-40167). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qh8g-58pp-2wxh Eclipse Jetty URI parsing of invalid authority
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2024-6763). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2fvj-hgj9-j2gr Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2026-10050). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hh26-6xwr-ggv7 Denial of service in Spring Framework
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2022-22970). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4gc7-5j7h-4qph Spring Framework DataBinder Case Sensitive Match Exception
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2024-38820). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g5mm-vmx4-3rg7 Improper handling of case sensitivity in Spring Framework
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2022-22968). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4487-x383-qpph Possible privilege escalation in org.springframework:spring-core
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2018-1272). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8crv-49fr-2h6j Spring Security and Spring Framework may not recognize certain paths that should be protected
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2016-5007). Fix: Update that package to its patched version.
  • Worth fixing GHSA-g8hw-794c-4j9g Path Traversal in org.springframework:spring-core
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2018-1271). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pgf9-h69p-pcgf Files or Directories Accessible to External Parties in org.springframework:spring-core
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2015-5211). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rcpf-vj53-7h2m Denial of Service in org.springframework:spring-core
    /workdirs/scan-d26da4e9-9524-46f4-b977-70f58d19b063/pom.xml
    A package you depend on has a known security hole (CVE-2018-1257). Fix: Update that package to its patched version.
… 34 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.