78 matches found
TokenBreaker
TokenBreaker Token Breaker は、JWT トークンに関連する2つの特定の脆弱性に焦点を当てています。 None アルゴリズム RSAtoHMAC 脆弱性の詳細と攻撃者がトークンを偽造する方法については、こちらのリンクを参照してください。 この脆弱性を試すにはこちら TheNone 使用法 usage: TheNone.py -h -t TOKEN TokenBreaker: 1.TheNoneAlgorithm optional arguments: -h, --help show this help message and exit required...
MyJWT
MyJWT codebeat badge はじめに このCLIは、ペネトレーションテスター、CTFプレイヤー、または開発者向けです。 JWTの修正、署名、インジェクションなどが可能です。 詳細はドキュメントをご確認ください。 問題点や改善点がありましたら、Issueを送信してください。できるだけ早く対応します。 お楽しみください : ドキュメント ドキュメントは http://myjwt.readthedocs.io で入手できます。 目次 機能 インストール 使い方 例 ダウンロード 貢献 変更履歴 機能 新しいJWTをクリップボードにコピー ユーザーインターフェース...
CVE-2026-21003-JWT-none-Algorithm-Bypass-via-kid-Header-Omission
CVE-2026-21003 – 通过省略 kid 标头绕过 JWT "none" 算法 程序代码（Node.js） // jwtverifyserver.js - Vulnerable JWT verification const jwt = require'jsonwebtoken'; const express = require'express'; const app = express; app.useexpress.json; const publicKey = -----BEGIN PUBLIC KEY-----...
Astra Linux – Vulnerability in Ceph
Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and earlier, it is possible to send a JWT with “none” as its JWT algorithm. By doing this, the JWT signature is not checked. The vulnerability lies most likely in the RadosGW OIDC provider. As of the time of...
CVE-2026-67336
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...
CVE-2026-67336 better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...
CVE-2026-67336
CVE-2026-67336 affects better-auth versions before 1.6.11, specifically the oidcProvider and mcp plugins. The root cause is insecure cryptographic defaults that advertise the none algorithm and allow plain PKCE by default. This can enable an attacker to exploit algorithm negotiation to accept uns...
CVE-2026-67336 better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...
CVE-2026-67336: Use of a Broken or Risky Cryptographic Algorithm
better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...
PT-2026-59247
Summary The LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid,...
GHSA-9H47-PQCX-HJR4 Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default
Am I affected? Users are affected if all of the following are true: - Their application uses better-auth at a version below the patched release. - Their application enables oidcProvider from better-auth/plugins/oidc-provider or mcp from better-auth/plugins/mcp the mcp plugin delegates to...
PT-2026-67316
Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 Description The oidcProvider and mcp plugins contain insecure cryptographic defaults. The discovery document advertises the none algorithm in id token signing alg values supported and resource signing alg...
CVE-2026-39413
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none'...
CVE-2026-39413 LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none'...
jwt-exploit-toolkit
JWT Exploit Toolkit !Pythonhttps://img.shields.io/badge/Py...
lightrag-hku: JWT Algorithm Confusion Vulnerability
Summary The LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid,...
GHSA-8FFJ-4HX4-9PGF lightrag-hku: JWT Algorithm Confusion Vulnerability
Summary The LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid,...
LightRAG 数据伪造问题漏洞
LightRAG is an open-source retrieval-enhanced generation application developed by the Data Intelligence Laboratory at the Hong Kong University HKU. Versions of LightRAG prior to 1.4.14 contained a data manipulation vulnerability caused by JWT algorithm exploitation attacks. This vulnerability...
CVE-2026-39413: Improper Verification of Cryptographic Signature
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode call does not explicitly deny the 'none'...