EUVD-2026-92093

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147

The SciPhi-AI R2R software (up to version 3.6.6 ) contains a vulnerability in the JWT Secret Handler component. The issue stems from the manipulation of the DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY arguments, which leads to the use of hard-coded credentials . This vulnerability can b...

CVE-2025-55449-AstrBot-RCE

소개 AstrBot=3.5.17 버전에서는 소스 코드에 JWT secret이 하드코딩되어 있어, 임의의 플러그인을 업로드하여 RCE를 달성할 수 있습니다. 사용 python main.py 'http://127.0.0.1:6185' 소스 코드 https://github.com/AstrBotDevs/AstrBot.git...

JFrog Artifactory Access Blank Join Key Authentication Bypass

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. id: CVE-2026-82329 info: name: JFrog Artifactory Access Blank Join Key Authentication Bypass author: johnk3r,pruv...

OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

CVE-2022-45771

CVE-2022-45771 PwnDoc는 경로 순회path traversal와 로컬 파일 포함LFI 취약점에 모두 노출되어 있으며, 이를 통해 권한이 없는 사용자가 JWT 시크릿을 노출시키고 코드 실행을 달성할 수 있습니다. 요구 사항: 공격자는 user 역할을 가진 유효한 계정을 보유해야 합니다. 애플리케이션에 finding.vulnType 또는 finding.category 태그가 포함된 보고서 템플릿이 있어야 합니다. 세부 사항 취약점 체인은 다음 부분들로 구성됩니다: 1. 모델 및 엔드포인트 수준 모두에서...

CVE-2025-8570

CVE-2025-8570 BeyondCart Connector = 2.1.0 - JWT Secret 구성 누락으로 인한 인증되지 않은 권한 상승 🚨 BeyondCart Connector = 2.1.0 - JWT 권한 상승 CVE-2025-8570 🛡️ 취약점 개요 WordPress용 BeyondCart Connector 플러그인은 버전 1.4.2부터 2.1.0까지 에서 determinecurrentuser 필터 내 잘못된 JWT 시크릿 관리와 결함이 있는 인증 메커니즘으로 인해 권한 상승Privilege Escalation...

CVE-2026-53519

Lab CVE-2026-53519 - Nezha Dashboard pre-auth path traversal Lab は pre-auth path traversal via/dashboard.. prefix confusion の脆弱性を再現します。 Nezha Dashboard において、jwtsecretkey の漏洩 - JWT 偽造 - admin 権限奪取に至ります。 Docker 環境で、version ごとに A/B を分離し vuln vs patched を比較します。 | Image| URL loopback| 期待される結果...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2025-55449

CVE-2025-55449 - AstrBot 원격 코드 실행RCE 취약점 개요 이 저장소는 AstrBot의 치명적인 원격 코드 실행RCE 취약점인 CVE-2025-55449 에 대한 개념 증명 익스플로잇을 포함합니다. 이 취약점은 취약한 JWT 인증과 플러그인 설치 메커니즘을 악용하여 공격자가 대상 시스템에서 임의 코드를 실행할 수 있게 합니다. 취약점 설명 이 취약점은 다음으로 인해 발생합니다: 1. 하드코딩된 JWT 비밀 키 : AstrBot은 인증을 위해 하드코딩된 JWT 비밀...

CVE-2025-68860

WordPress Mobile Builder = 1.4.2 - 인증 우회 CVE-2025-68860 설명 WordPress Mobile builder 플러그인 버전 1.4.2 이하는 인증 우회 취약점이 존재하며, 공격자는 기본 시크릿 "examplekey"로 유효한 JWT 토큰을 생성하여 관리자userid=1로 인증할 수 있습니다. 해당 토큰을 사용하여 공격자는 새로운 관리자 계정을 생성하고 사이트를 장악할 수 있습니다. 취약점 세부 정보 CVE: CVE-2025-68860 원인: JWT에 하드코딩된 시크릿 키...

EUVD-2026-87368

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502

Flame through version 2.4.0 is vulnerable to an insufficient session expiration vulnerability in its login endpoint. Attackers who possess former administrator access can exploit unvalidated duration parameters to obtain tokens with arbitrary lifespans. Because tokens are verified against a stati...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502: Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...