TencentOS Server 4: grafana (TSSA-2026:1370)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1370 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2018-0114

CVE-2018-0114 Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT. This vulnerability in Cisco's node-jose allows an attacker to forge malicious tokens. JWT allows users to embed public keys using the jwk value inside the header of the token. However,...

POC-CVE-2018-0114

CVE-2018-0114 POC A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON...

jwt-spoof-tool

jwt-spoof-tool Tool Description : I made this tool for learning purpose and automating jwt token hijacking without depending on using burpsuite the code is well documented and easy to follow Based on CVE-2018-0114 The Vulnerabilty happend because in backend the server check jwk object embeded...

CVE-2026-65631

A flaw was found in jose. An unauthenticated remote attacker can exploit this vulnerability to cause a Denial of Service DoS by submitting a specially crafted JSON Web Key JWK. When processing an RSA key that lacks certain mathematical parameters, the library attempts to calculate the missing...

CVE-2026-65628

A flaw was found in jose. This flaw allows an attacker to cause a Denial of Service DoS by triggering an infinite loop during cryptographic key derivation. When deriving a shared secret, passing two JSON Web Keys JWKs with mismatched key types causes the sharedsecret function to enter unbounded...

pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance

A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance

A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

CVE-2018-0114-PoC

CVE-2018-0114 PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Example $ python3 script.py Making keys... 'alg': 'RS256', 'jwk': 'kty': 'RSA', 'kid': '[email protected]', 'use':...

CVE-2026-116587

A flaw was found in go-jose. A remote attacker can cause a Denial of Service DoS by supplying a crafted JSON Web Key JWK with oversized or degenerate RSA cryptographic parameters. Because the library fails to enforce size and consistency bounds prior to validation, processing these malicious keys...

Go JOSE: DoS When Parsing JWKs That Contain RSA Keys

Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to "crypto/rsa.PrivateKey.Validate". On Go 1.24+, this takes cubic time...

Go JOSE: DoS when parsing JWKs that contain RSA keys

Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate. On Go 1.24+, this takes cubic time complexit...

EUVD-2026-110467

Go JOSE: DoS when parsing JWKs that contain RSA keys...

GHSA-MGCC-CWW5-FP2Q Go JOSE: DoS when parsing JWKs that contain RSA keys

Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate. On Go 1.24+, this takes cubic time complexit...