Sonatype Nexus Repository 3 Pro fails to enforce the local account status when a user logs in through a configured SAML or OAuth2/OpenID Connect identity provider. The defect permits a user whose local account has been disabled or locked by an administrator to re‑authenticate with valid identity provider credentials. Once signed in, the session is granted the roles associated with the original account, effectively bypassing the intended access restriction. This grants the attacker the privileges of the disabled account without any Nexus Repository session or privilege escalation through standard edit pathways.

Vendors: Sonatype. Product: Nexus Repository 3. Versions: All releases from 3.86.0 through 3.97.1 are listed as affected, as indicated by the CPE ranges. Any instance of Nexus Repository 3 operating with a SAML or OAuth2/OpenID Connect identity provider configuration is potentially impacted.

The vulnerability carries a CVSS score of 9.1, indicating a high severity. The EPSS score is not available, but the flaw is well documented and could be leveraged by an attacker who possesses valid credentials for a disabled account. Because the attacker requires no existing Nexus session or administrative privilege, the attack vector is considered Remote. The problem is not listed in the CISA KEV catalog, yet the high impact warrants immediate remediation.