1817 matches found
CVE-2025-63217
The CVE describes an Authentication Bypass in the Itel DAB MUX (IDMUX build c041640a) caused by improper JWT validation across devices. Exploitation would allow an attacker who has a valid JWT from one device to authenticate as an administrator on any other device running the same firmware, enabl...
PT-2025-47409
Name of the Vulnerable Software and Affected Versions Itel DAB Gateway versions c041640a Description The Itel DAB Gateway is susceptible to an authentication bypass due to inadequate JWT JSON Web Token validation. An attacker can exploit this by reusing a valid JWT token acquired from one device ...
CVE-2025-63216
CVE-2025-63216 concerns the Itel DAB Gateway (IDGat build c041640a) where authentication is bypassed due to improper JWT validation. Attackers can reuse a valid JWT token from one device to authenticate and gain administrative access on any other device running the same firmware, enabling full co...
CVE-2025-56643
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and may allow unauthorized access if a toke...
joserfc 安全漏洞
joserfc is a Python library open-sourced by Authlib. A security vulnerability exists in joserfc version 1.3.3 up to and including version 1.3.5 and version 1.4.0 up to and including version 1.4.2, which stems from an ExceededSizeError exception message embedded in the Undecoded JWT Token section,...
CVE-2025-63216
The Itel DAB Gateway IDGat build c041640a is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the...
PT-2025-47410
Name of the Vulnerable Software and Affected Versions Itel DAB MUX versions affected versions not specified Description The Itel DAB MUX IDMUX build c041640a has a flaw in how it verifies JWT JSON Web Token authentication. This allows an attacker who has a valid JWT token from one device to use i...
EUVD-2025-197729
A vulnerability was identified in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Impacted is the function JwtAuthenticationFilter of the file src/main/java/com/suisung/shopsuite/common/security/JwtAuthenticationFilter.java. The manipulation leads to path...
GHSA-4M32-CJV7-F425 AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Summary AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin. Details AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python...
EUVD-2025-197660
AstrBot is vulnerable to RCE with hard-coded JWT signing keys...
AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Summary AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin. Details AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python...
PT-2025-47033
Name of the Vulnerable Software and Affected Versions AstrBot version 3.5.15 Description The software uses a hard-coded private key, "Advanced System for Text Response and Bot Operations Tool", to sign JSON Web Tokens JWT, which are compact, URL-safe means of representing claims to be transferred...
EUVD-2025-178873
Malicious code in forever-cygnus-postcss-jwt npm...
EUVD-2025-175454
Malicious code in yaml-cache-sails-jwt npm...
EUVD-2025-176271
Malicious code in spectron-commitizen-server-jwt npm...
EUVD-2025-178062
Malicious code in lithosphere-buffer-jwt-prettier npm...
MAL-2025-187009 Malicious code in forever-cygnus-postcss-jwt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89fd6949db8f73f60ad61fd46e85a491a3d296a9479c600d2a79f928c0d66e92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
GHSA-9MJ6-HXHV-W67J jose2go is vulnerable to a JWT bomb attack through its decode function
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service DoS via crafted JSON Web Encryption JWE token with an exceptionally high compression ratio...
Malicious code in jwt-leda-framework-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb4f8cb8d4f557c3034d71e7ecaf0ff765c06e1a8805438ce959a7d22ca3637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...