impersonate-rs

IRS Impersonate-RS 💡 IRS is a library version of https://github.com/zblurx/impersonate-rs, zblurx Reimplementation of Defte Impersonate in plain Rust. For more informations about it, see this blogpost. The token impersonation approach is a bit different from Defte Impersonate : here you have to...

CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

CVE-2026-101287

Stela, versions prior to 1.60.1 , is vulnerable to an authentication bypass because it fails to validate the integrity of the "authProcess" cookie. The application relies on this cookie to store the userId and validSteps values; since these can be modified by a client, a remote attacker can imper...

CVE-2026-85298

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...

CVE-2026-85298

The Google Cloud Application Integration service (versions prior to 2026-08-27 ) is vulnerable to an Incorrect Authorization vulnerability. The root cause exists in the AuthConfig validation and integration execution runtime , which allows an authenticated user to perform privilege escalation and...

EUVD-2026-101004

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...

CVE-2026-85298 Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was...

Vulnerabilities in Microsoft Windows

Microsoft has identified 1,159 vulnerabilities in Windows. It is too complex to list every vulnerability individually. The 53 most severe vulnerabilities, with a CVSS score of 9 or higher, are listed below. These vulnerabilities give malicious actors the ability to impersonate other users, gain...

EUVD-2026-98161

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS...

CVE-2026-109598

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

CVE-2026-109598 Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS...

CVE-2026-109598 Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS...

PT-2026-111017

Name of the Vulnerable Software and Affected Versions Frappe Framework versions prior to 15.120.0 Frappe Framework versions 16.x prior to 16.33.0 Description An authorization flaw exists in the whitelisted 'send sms' API endpoint. The system fails to verify if the caller has the necessary...

EUVD-2026-97011

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience t...

CVE-2026-108753 Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and...

PT-2026-110179

Name of the Vulnerable Software and Affected Versions BotSharp versions prior to 5.2.1 Description An authentication bypass exists that allows unauthenticated remote attackers to forge bearer tokens. This is possible because the WebStarter appsettings.json file contains a hard-coded Jwt:Key...

impersonate

Impersonate Beschreibung Dieses Repository enthält die Werkzeuge, die beim Schreiben des folgenden Blogbeitrags https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ entwickelt wurden. Der Blogbeitrag enthält alle notwendigen Informationen, ...

EUVD-2026-95895

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-88648

A flaw was found in GnuTLS. An attacker controlling a subordinate Certificate Authority CA can exploit an incomplete X.509 certificate validation mechanism to bypass cross-domain Public Key Infrastructure PKI restrictions. This allows unauthorized certificates to be accepted as valid, potentially...