TokenBreaker

TokenBreaker Token Breaker is focused on 2 particular vulnerability related to JWT tokens. None Algorithm RSAtoHMAC Refer to this link about insights of the vulnerability and how an attacker can forge the tokens Try out this vulnerability here TheNone Usage usage: TheNone.py -h -t TOKEN...

cve-2026-102268-poc

CVE-2026-102268 — Contournement de la détection PEM asymétrique de PyJWT Résultat de l'analyse d'exploitabilité : la cause racine est confirmée et l'exploitation de bout en bout est reproductible. Une clé publique PEM mutée par des espaces blancs contourne le garde-fou ispemformat de PyJWT et est...

poc-cve-2016-10555

Change the algorithm RS256asymmetric to HS256symmetric - POC CVE-2016-10555 The algorithm HS256 uses the secret key to sign and verify each message. The algorithm RS256 uses the private key to sign the message and uses the public key for authentication. If you change the algorithm from RS256 to...

RS256-2-HS256

RS256-2-HS256 JWT Attack to change the algorithm RS256 to HS256 Usage usage: RS2562HS256JWT.py -h payload pubkey positional arguments: payload JSON payload from JWT to attack pubkey Public key file to use for signing optional arguments: -h, --help show this help message and exit Example...

NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.0, = 6.2.4...

EUVD-2026-95347

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107722

The fast-jwt library (versions 6.2.0 to 6.3.0 ) is vulnerable to RSA→HS256 algorithm confusion due to an incomplete patch of CVE-2026-34950. The root cause resides in src/crypto.js, where performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored. This allows...

CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-15013

CVE-2026-15013 — تجاوز المصادقة في miniOrange SAML SSO = 5.4.3 PoC إثبات المفهوم لـ CVE-2026-15013 : تجاوز مصادقة دون تسجيل دخول عبر التباس خوارزمية التوقيع HMAC-SHA1 في إضافة ووردبريس SAML Single Sign On – SSO Login من miniOrange الإصدارات حتى 5.4.3 ضمناً. للاستخدام في الاختبارات المصرّح بها فقط...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k...

CVE-2026-0265-check

أداة تقييم الثغرة الأمنية CVE-2026-0265 تحديد ما إذا كانت بوابة GlobalProtect الخاصة بـ Palo Alto Networks PAN-OS معرضة للثغرة CVE-2026-0265 بأمان دون المصادقة على أي جلسة أو تعديل أي حالة. الوصف CVE-2026-0265 هي ثغرة تجاوز المصادقة عن بُعد تؤثر على PAN-OS وPanorama ويتم تفعيلها عند استخدام ملف...

CVE-2026-85394

A flaw was found in python-jose. A remote attacker who obtains the service's public key can exploit an algorithm confusion vulnerability when signature verification algorithms are not strictly restricted. By utilizing a specifically formatted public key as a shared secret key, the attacker can...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – Confusion d'algorithme JWT via injection de kid Code du programme serveur Node.js + exploit Python // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient = require'jwks-rsa'; const axios =...

CVE-2026-78903-SWIFT-Kick-to-the-Creds

CVE-2026-78903 — SWIFT Kick to the Creds Confusion d'algorithme JWT de la passerelle API SWIFT Champ| Valeur ---|--- Sévérité| 9.1 Critique Vecteur| Réseau Versions concernées| 3.2.0 – 3.2.4 Découvert par| 𝕍𝕠𝕤𝕤🥷 Description Une erreur de configuration critique dans la passerelle API SWIFT permet ...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 — WSO2 Le mécanisme d'authentification JWT accepte des jetons signés avec des algorithmes autres que ceux explicitement configurés ou pris en charge. Cela permet à un attaquant de forger un J...

POC_CVE-2015-9235

CVE-2015-9235 Demonstration of the algorithm confusion attack on Json Web Token JWT libraries. JWTs are often used in cookies to certify a user session and so this attack is critical. The node module [email protected] was used to demonstrate the vulnerability. This project was also a nice vi...

CVE-2023-48223

CVE-2023-48223 PoC fast-jwt Algorithm Confusion This repository demonstrates JWT algorithm confusion in fast-jwt when token verification does not lock allowed algorithms. Environment Setup Requirements Node.js 18 or newer npm OpenSSL must be available in your terminal PATH 1 Install dependencies...

Exploit for CVE-2026-102268

CVE-2026-102268 — PyJWT Asymmetric-PEM Detection Bypass E...

PYSEC-2026-4150 PyJWT BOM Bypass

Affected Package - Package: PyJWT pyjwt on PyPI - Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt&source=gmail&ust=1781794518474000&sa=E - Affected version: 2.13.0 - Vulnerability class: Algorithm confusion / patch bypass --- Root Cause PyJWT 2.13.0 introduced a guard i...