CLSA-2026-1774657370 TuxCare security update for jsonwebtoken (2 CVEs)

TuxCare rebuilt jsonwebtoken to address 2 CVEs. Fixed in 0.4.0-tuxcare.1...

PYSEC-2026-3595 Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Summary With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perfor...

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

SummaryWith Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout per-token jti and OIDC back-channel logout per-user revokedat record revocations in Redis, and HTTP auth getcurrentuser rejects revoked tokens with 401. The realtime authentication surfaces do not perform...

RHEL 8 / 9 : Satellite 6.16.12 Async Update (Important) (RHSA-2026:50223)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50223 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessi...

CVE-2026-48031

Technical details about CVE-2026-48031 are not publicly provided in the supplied documents. The go-base JWT-secret issue is described at a high level; monitor for updates for concrete affected versions, root cause, and fixes.

EUVD-2026-52408

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

Exploit for Stack-based Buffer Overflow in Google Chrome

--- CVE-2026-4444 – JWT Algorithm Confusion via kid Injectio...

openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:21515-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21515-1 advisory. Changes in python-joserfc: - CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT malleability and allows for bypass of token...

CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-8457

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

CVE-2026-8457 WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

CVE-2026-55735

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only base64-decodes...

EEF-CVE-2026-55735 Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Summary Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification it only...

SUSE CVE-2026-33757

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with callbackmode set to direct. This allows an attacker to start an authentication request and perform "remote phishin...

PT-2026-67342

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id token and decoding only its base64 payload without verifying the JWT signature against Apple...

OPENSUSE-SU-2026:21515-1 Security update for python-joserfc

This update for python-joserfc fixes the following issues: Changes in python-joserfc: - CVE-2026-62995: acceptance of JWTs with trailing padding can lead to JWT malleability and allows for bypass of token revocation and anti-replay protection bsc1272991...

CVE-2026-18208

Affected product: Keycloak (keycloak-services OIDC token introspection endpoint). Issue: when a confidential client that expects signed JWT introspection responses inspects a token issued for a different audience, the endpoint still returns the full set of token claims inside a signed JWT field e...

CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

SUSE CVE-2026-9097

Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken function in object/tokenoauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revok...

PT-2026-66724

Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the OIDC token introspection endpoint of the keycloak-services component. The issue occurs when a confidential client, configured to receive signed JWT JSON Web Tok...