CVE-2026-77519 MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...

CVE-2026-77519

MaxKB (an open-source enterprise AI assistant) versions 2.10.2-lts and earlier contain an authentication inconsistency in the /chat/api/mcp endpoint. The MCP authentication path validates ApplicationApiKey using only the secret and active status, omitting the is_permanent and expire_time checks e...

CVE-2026-77519 MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...

PT-2026-96255

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description The authentication process for the '/chat/api/mcp' endpoint fails to enforce is permanent and expire time checks when validating an ApplicationApiKey. It only verifies the secret and active status...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date via the SavePasswordController::handle process. An attacker can gain unauthorized access to user accounts by submitting expired password reset tokens directly to the reset endpoint, bypassing the...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity through a trusted signer-asserted timestamp in the getSignatureTime method of the S/MIME validator, which returns the CMS signingTime signed attribute and passes it to PKIXCertPathReviewer...

CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

DEBIAN-CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

AZL-94425 CVE-2026-54787 affecting package gh for versions less than 2.97.0-1

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

Use of a Key Past its Expiration Date

Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date through the public-key verification path in pkg/verify/signedentity.go. An attacker can get a bundle signed with expired long-lived key material accepted by supplying a signed bundle whose timestamp...

CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787 sigstore-go fails to check signature timestamps against a signing key's validity period

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

CVE-2026-54787: Use of a Key Past its Expiration Date

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

EUVD-2025-34355

Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally...

CVE-2025-48813

Use of a key past its expiration date in Virtual Secure Mode allows an authorized attacker to perform spoofing locally...

PT-2025-41996

Name of the Vulnerable Software and Affected Versions Versions prior to 2025 Description The use of a key after its expiration date within Virtual Secure Mode can allow a local attacker to perform spoofing. Recommendations At the moment, there is no information about a newer version that contains...