Lucene search
+L

143 matches found

Kitploit
Kitploit
added 2026/09/03 1:31 a.m.3 views

CVE-2026-29000-pac4j-jwt

pac4j-jwe-forge CVE-2026-29000 Proof-of-concept for CVE-2026-29000. Targets pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability is straightforward: the library accepts a PlainJWT unsigned, alg=none as long as it's wrapped inside a valid JWE. Since the server exposes its RSA...

9.3CVSS7AI score0.05856EPSS
SaveExploits17References1
Kitploit
Kitploit
added 2026/09/02 10:35 p.m.5 views

hydra

Chat · Debates · Boletín · Documentación · Prueba Ory Network · Empleo Ory Hydra es un servidor OAuth 2.0 reforzado y certificado OpenID, así como un proveedor de OpenID Connect, optimizado para baja latencia, alto rendimiento y bajo consumo de recursos. Se conecta a su proveedor de identidad...

6AI score
SaveExploits0References6
NVD
NVD
added 2026/09/02 3:17 p.m.3 views

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

9CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/02 2:43 p.m.4 views

EUVD-2026-70056

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

9CVSS5.8AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 2:43 p.m.14 views

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

9CVSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/09/02 2:43 p.m.4 views

CVE-2026-82955

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...

9CVSS5.8AI score
SaveExploits0References2
CVE
CVE
added 2026/09/02 2:43 p.m.7 views

CVE-2026-82955

In the unreleased development version of Eclipse aeriOS , the KrakenD instance within the API Gateway component had the disable_jwk_security parameter hard-coded to true with no Helm chart override. This disabled TLS certificate verification when KrakenD fetched the JWKS used for bearer token val...

9CVSS5.8AI score
SaveExploits0References2
NVD
NVD
added 2026/08/13 1:19 p.m.6 views

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

8.7CVSS0.00175EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/13 1:08 p.m.69 views

CVE-2026-49478

Fulcio (certificate authority for OpenID Connect) reports a vulnerability in OIDC discovery across versions up to 1.8.5 where cross-host redirects attach Kubernetes ServiceAccount tokens, enabling blind SSRF, JWKS key substitution/poisoning, and potential leakage of tokens to external hosts. The ...

8.7CVSS8.3AI score0.00175EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/13 1:08 p.m.10 views

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

8.7CVSS5.4AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/13 1:08 p.m.45 views

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

8.7CVSS0.00175EPSS
SaveExploits0References4
Amazon
Amazon
added 2026/08/04 12:00 a.m.14 views

Important: runfinch-finch

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

7.8CVSS7.8AI score0.00447EPSS
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2026/08/04 12:00 a.m.12 views

Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-2023)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2023 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

8.7CVSS7.9AI score0.00447EPSS
SaveExploits0References12
ATTACKERKB
ATTACKERKB
added 2026/07/30 2:16 p.m.12 views

CVE-2026-54885

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...

6.9CVSS6.1AI score0.00372EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/07/30 2:16 p.m.10 views

CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...

6.9CVSS6.1AI score0.00372EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/30 2:16 p.m.28 views

CVE-2026-54885

Boruta exposes a Server-Side Request Forgery (SSRF) in its OAuth/OpenID flow. Three code paths fetch URIs supplied by the requester (request_uri and jwks_uri) with minimal validation: only scheme presence, no HTTPS enforcement, no host/IP allowlist, and no checks against loopback/private ranges o...

6.9CVSS6.1AI score0.00372EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/30 8:16 a.m.16 views

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

8.8CVSS0.00239EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/30 7:23 a.m.11 views

CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

8.8CVSS5.5AI score
SaveExploits0References4
CVE
CVE
added 2026/07/30 7:23 a.m.55 views

CVE-2026-18353

PIA’s POST /v1/upload/sbom validates a Bearer JWT by checking the unverified iss against an issuer allowlist using urlparse, then performs OIDC discovery with requests. A backslash in the authority (e.g., https://[email protected]/) is parsed into different hostnames, enabling an attac...

8.8CVSS6AI score0.00239EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/20 12:19 p.m.20 views

CVE-2026-63744

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...

5.1CVSS0.00324EPSS
SaveExploits0References2
Rows per page
Query Builder