# CVE-2026-113373: Sonatype Nexus Repository 3 Pro account status bypass in SAML/OAuth2

Source: https://junglewise.ai/threats/cve-2026-113373-sonatype-nexus-repository-3-pro-does-not-check-the-local-account  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-113373 · Severity: info · Published 2026-11-04

Sonatype Nexus Repository 3 Pro is a software component repository manager used by organizations to manage software dependencies and artifacts. An attacker with valid credentials at a connected identity provider (such as a corporate SAML or OAuth2 server) can bypass account lockout or disablement, regaining access to the repository and the permissions associated with their account. This allows a terminated or suspended employee, or an account compromised at the identity provider level, to restore access to sensitive software artifacts.

Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-113373 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113373 being exploited in the wild.

**How severe is CVE-2026-113373?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Sonatype Nexus Repository 3 Pro.

**Is there a fix for CVE-2026-113373?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-113373 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-113373?** Check whether you run Sonatype Nexus Repository 3 Pro. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

When users authenticate via SAML or OAuth2/OpenID Connect, Nexus Repository 3 Pro does not validate whether the corresponding local account has been disabled or locked by administrators. An attacker with valid identity provider credentials for a named account can obtain a new authenticated session with the original account's roles, bypassing administrative account controls. The attack requires valid credentials at the external identity provider but no pre-existing Nexus session or Nexus-level privilege.

## Affected products

- Sonatype Nexus Repository 3 Pro

## Timeline

- 2026-11-04: disclosed

## References

- [https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html](https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html)
- [https://support.sonatype.com/hc/en-us/articles/56614238092947/](https://support.sonatype.com/hc/en-us/articles/56614238092947/)

## Related threats

- [Sonatype Nexus Repository 3 privilege escalation in role management](https://junglewise.ai/threats/cve-2026-97712-sonatype-nexus-repository-3-allows-a-user-that-holds-the-role)