SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity

SCTT-2026-33-0004: FortiCloud SSO アイデンティティ特異点 これはSCTT-0004ベクターの完全な実装です。 📡 技術分析 Fortinetの2026年1月27日付のCVE-2026-24858 に対する緩和策は、[email protected]のような特定のアカウントをブロックすることに焦点を当てていますが、SAMLステートマシンの時間的脆弱性 には対処できていません。 $\alpha = 0.0302011$定数...

CTT-Refraction-Vortex-CVE-2026-7731-

CTT-Refraction-Vortex-CVE-2026-7731- Under CTT, we see it as a Temporal Synchronization Mismatch between the Identity Provider and the Service Provider. By injecting a pulse at the \alpha=0.0302011 frequency, we don't bypass the signature—we Refract the Time Window so the signature validates...

CVE-2025-1868

CVE-2025-1868: Advanced IP Scanner & Advanced Port Scanner NTLM Leakage HTTP Tester Small dockerized PHP app that triggers an NTLM handshake and extracts the claimed domain , user , and workstation from NTLM Type 3 messages. It does not validate passwords. It does not store challenges. It only lo...

EUVD-2026-86277

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611

The open-source identity provider authentik is vulnerable to unauthorized credential exposure in versions prior to 2026.2.7 , 2026.5.7 , and 2026.8.2 . The authentik API serializers incorrectly return stored credentials when a user possesses view permission on an affected configuration, even if t...

CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

tor-ip-changer

tor-ip-changer request new identity every X seconds interval using TOR client !!!iam not responsible for anything what you will do with this program, or for any other sts !!! it is for education purposes only...

CVE-2023-34362

CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfer Technical Analysis A technical root cause analysis of the vulnerability can be found on the blog: Summary This POC abuses an SQL injection to obtain a sysadmin API access token and then uses that access to abuse a deserialization cal...

CVE-2022-22954-Testi

CVE-2022-22954-Testing Testing the CVE-2022-22954 Vulnerability VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result ...

CVE-2023-49496_PoC

CVE-2023-49496PoC Description UCServer is an advanced converged communication server. Shanghai Shupin Information Technology Co., Ltd. UCServer has a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive database information. POC root@kitploit: POST...

CVE-2026-94416

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

nexus-os

Nexus OS The Governed Agentic AI Operating System 66 Crates | 675 Commands | 86 Pages | 5,229 Tests | 10/10 OWASP | Zero Stubs Local-first. Air-gappable. Post-quantum ready. Built in Rust. Architecture | Quick Start | Features | Audit Status | Docs Nexus OS is an AI agent operating system where...

EUVD-2026-85867

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

CVE-2026-94416

An authorization bypass exists in the Ansible Automation Platform (AAP) gateway due to a lack of restrictions on service key creation . An authenticated administrator can create a new service key for the Controller service cluster that is cryptographically indistinguishable from legitimate keys. ...

CVE-2026-94416 Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

CVE-2026-94416

An authorization bypass was found in the Ansible Automation Platform AAP gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an...

keycloak__keycloak_CVE-2022-4361_21-1-1

Keycloak Keycloak is an Open Source Identity and Access Management solution for modern Applications and Services. This repository contains the source code for the Keycloak Server, Java adapters and the JavaScript adapter. Help and Documentation Documentation User Mailing List - Mailing list for...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: root@kitploit: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file |...

CVE-2026-97176 Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...