Sonatype Nexus Security Advisory
Date: November 4, 2026
Affected Versions: Sonatype Nexus Repository 3 Pro versions 3.86.0 up to and including 3.97.x
Fixed in Version: Sonatype Nexus Repository 3 Pro version 3.98.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N = 9.1 (Critical)
CWE: CWE-1390: Weak Authentication
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-113373
Summary
Sonatype Nexus Repository 3 Pro does not check the status of a local user account when that user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. An administrator can disable or lock such an account in Nexus Repository. A person who still has valid identity provider credentials for that account can then sign in again and receive a new session with the roles of that account.
The sign-in does not need a Nexus Repository session or any Nexus Repository privilege. It needs only valid identity provider credentials for the affected account. The anonymous user is not part of this attack path.
We are not aware of active exploitation of this vulnerability at the time of this announcement.
Recommendation
Upgrade to Sonatype Nexus Repository 3 Pro version 3.98.0 or later. You can download the latest version from https://help.sonatype.com/en/download.html.
After you upgrade, review your authentication logs for sign-ins by accounts that an administrator had disabled or locked in Nexus Repository. If you find any, treat the activity of those accounts as suspect and review it.
Immediate Mitigation Options
If you cannot upgrade now, do the following in addition to disabling or locking the account in Nexus Repository:
- Disable the account in your identity provider, or remove it from the groups that map to Nexus Repository roles. This removes the credentials that are needed to sign in again.
- If you cannot change the identity provider, you can deactivate the SAML or OAuth2/OpenID Connect realm until you upgrade. This stops all single sign-on logins, not only the logins of disabled accounts.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: A user whose access an administrator removed in Nexus Repository can regain it. The user gets the roles that are mapped to the account. This can include read access to private repositories, the ability to publish components, or administrator functions, depending on how roles are mapped in your deployment.
Q: What preconditions must be met in order to be vulnerable?
A: All of the following must be true:
- You run Sonatype Nexus Repository 3 Pro in an affected version.
- A SAML or OAuth2/OpenID Connect realm is enabled.
- An account for the user exists in Nexus Repository, and an administrator has disabled or locked it.
- The user still has valid credentials for the same account at the identity provider.
The user must sign in with their own identity provider account, which must be a named account that holds valid credentials. The anonymous user cannot meet these conditions.
Q: Are there implications associated with this advisory itself?
A: Public disclosure of a vulnerability can make it easier for malicious actors to find and target unpatched systems. We recommend that you assess the impact on your environment and take the actions in this advisory as soon as possible.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process. We publish this advisory after a fix is available, so that customers can protect their systems and make informed decisions about risk.