CVE-2021-27850_POC

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache...

CVE-2021-27850_POC

CVE-2021-27850 Exploit Overview CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache...

CVE_2021_27850_POC

Usage git clone https://github.com/Ovi3/CVE202127850POC.git cd CVE202127850POC/ gradlew runnbaleJar java -jar ./build/libs/CVE202127850POC-1.0-SNAPSHOT.jar Usage: java TapestryExploit Tapestry Key DNS URL java TapestryExploit Tapestry Key CB2 Command Assuming the HMAC key is change this immediate...

CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...

CVE-2026-102273

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2026-97055

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

EUVD-2026-85774

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

CVE-2026-97055

SigNoz versions v0.8.0 before v0.143.0 are vulnerable to an authentication bypass because the JWT tokenizer signing secret defaults to an empty string. Since Config.Validate() fails to reject empty values, deployments without a configured secret sign and verify session tokens with an empty HMAC k...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3714)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)

The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...

SUSE CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

CVE-2026-83551

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

EUVD-2026-66418

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587

CVE-2026-12587 affects the Virtuagym application, where a static, hard-coded badge_number parameter is used as the HMAC private key for generating physical access QR codes. This value is exposed via the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info, and the cryptographic logic...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

PT-2026-82090

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge number' parameter as the HMAC private key, the value of which remains static and is accessible via the API usi...