14 matches found
CVE-2026-54239
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...
CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...
EUVD-2026-82383
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...
CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...
CVE-2026-54239
FaustWP (a WordPress plugin within the Faust.js headless WordPress toolkit) contains an authentication bypass prior to version 1.8.11 . The root cause is in WPE\FaustWP\Auth\encrypt() and decrypt() (in plugins/faustwp/includes/auth/functions.php): the 16-byte initialization vector is excluded fro...
CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...
CVE-2026-54239: Insufficient Verification of Data Authenticity
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...
PT-2026-95063
Name of the Vulnerable Software and Affected Versions FaustWP versions prior to 1.8.11 Description The FaustWP WordPress plugin fails to include the 16-byte initialization vector in the HMAC Hash-based Message Authentication Code, a mechanism for verifying data integrity within the encrypt and...
Malicious code in faustwp (npm)
The package faustwp was found to contain malicious code...
Malicious code in faustwp-cli (npm)
The package faustwp-cli was found to contain malicious code...
Malicious code in faustwp-core (npm)
The package faustwp-core was found to contain malicious code...
MAL-2025-20250 Malicious code in faustwp-cli (npm)
The package faustwp-cli was found to contain malicious code...