CVE-2026-49332 Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

CVE-2026-49332

The CVE-2026-49332 entry concerns openshift/oauth-proxy. Affected component: the proxy handling of authenticated identity headers. Root cause: the proxy uses dash-variant headers (e.g., X-Forwarded-User) but does not strip underscore-variant headers (X_Forwarded_User). Because WSGI and PHP framew...

CVE-2026-49332

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

Ipswitch IMail Server - Detect

Detects servers running Ipswitch IMail by identifying the Server header in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects servers running Ipswitch IMail by identifying the Server header in HTTP responses.""" from kittysploit import from lib.protocols.http.httpclient import...

Starlette - Improper Validation of Unsafe Equivalence in Input Detection

A flaw was found in Starlette, a lightweight ASGI Asynchronous Server Gateway Interface framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading...

Apache Filename Enumeration Detection

If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...

ZZcms - Cross-Site Scripting Detection

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. !/usr/bin/env python3 -- coding: utf-8 --...

Nostromo Web Server Detection

Detected servers running the Nostromo web server by identifying the Server header in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers running the Nostromo web server by identifying the Server header in HTTP responses.""" from kittysploit import from...

OpenVPN Host Header Injection Detection

A vulnerability in OpenVPN Access Server allows remote attackers to inject arbitrary redirection URLs by using the 'Host' HTTP header field. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in OpenVPN Access Server allows remote attackers to inject arbitrary redirection URLs by...

Microsoft IIS version detect

Some Microsoft IIS servers have the version on the response header. Useful when you need to find specific CVEs on your targets. !/usr/bin/env python3 -- coding: utf-8 -- """Some Microsoft IIS servers have the version on the response header.""" from kittysploit import from...

MochiWeb - Detect

Detected servers using the MochiWeb framework through the Server header. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers using the MochiWeb framework through the Server header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Onion Website Supported via Onion-Location Header Detection

Identified websites that supported Tor network access through the Onion-Location HTTP response header, which pointed to a corresponding .onion service for enhanced privacy and anonymity. !/usr/bin/env python3 -- coding: utf-8 -- """Identified websites that supported Tor network access through the...

Nginx version detect

Some nginx servers have the version on the response header. Useful when you need to find specific CVEs on your targets. !/usr/bin/env python3 -- coding: utf-8 -- """Some nginx servers have the version on the response header.""" import re from kittysploit import from lib.protocols.http.httpclient...

OpenConnect VPN Server (ocserv) - Detect

OpenConnect VPN Server ocserv is an open-source VPN server compatible with Cisco AnyConnect clients. It uses DTLS and TLS for secure connectivity and is commonly exposed on port 443 or 4443. The server header can expose OpenConnect or ocserv-specific markers. !/usr/bin/env python3 -- coding: utf-...

QSAN Storage Manager <3.3.3 - Cross-Site Scripting Detection

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. !/usr/bin/env python3 -- coding: utf-8 -- """QSAN Storage Manager before...

Apache Detection

Some Apache servers have the version on the response header. The OpenSSL version can be also obtained !/usr/bin/env python3 -- coding: utf-8 -- """Some Apache servers have the version on the response header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Akamai Cache Detection

Sends a HEAD request with a Pragma header value of "akamai-x-cache-on" and looks for an akamai-specific response header value. !/usr/bin/env python3 -- coding: utf-8 -- """Sends a HEAD request with a Pragma header value of "akamai-x-cache-on" and looks for an akamai-specific respon.""" import re...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage Detection

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. !/usr/bin/env python3 -- coding: utf-8 -- """Eclipse Jetty before 9.""" from kittysploit import from lib.protocols.http.httpclient import...

Apache Struts2 S2-008 RCE Detection

The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. !/usr/bin/env python3 -- coding: utf-8...

CherryPy Web Server - Detect

Detects servers running the CherryPy web server by identifying the Server header in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects servers running the CherryPy web server by identifying the Server header in HTTP responses.""" from kittysploit import from...