cve-2026-29000

CVE-2026-29000 エクスプロイト pac4j-jwt における JWE ラップ PlainJWT を介した JWT 認証バイパス 脆弱性の説明 CVE-2026-29000 は、4.5.9、5.7.9、6.3.3 より前のバージョンの pac4j-jwt に影響を与える重大な認証バイパス脆弱性です。この脆弱性により、リモートの攻撃者が認証トークンを偽造し、署名検証をバイパスできるようになります。 技術的詳細 この脆弱性は、暗号化された JWT（JWE）を処理する際に JwtAuthenticator コンポーネントに存在します。JWE トークンを受信すると： 1. サーバーは...

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT 인증 우회 데모 프로젝트 목표 이 프로젝트는 통제된 로컬 랩 환경에서 CVE-2022-39227 취약점을 시연합니다. 이 취약점은 python-jwt 라이브러리3.3.4 미만 버전에 영향을 미치며, 공격자가 python-jwt와 해당 의존성인 jwcrypto 간의 파싱 불일치JWS 직렬화를 악용하여 비밀 키 없이 JWT 클레임을 위조할 수 있게 합니다. 기술 스택 Python 3.9 Flask 웹 프레임워크 python-jwt 3.3.3 취약한 버전 python-jwt 3.3.4 수정/패치된 ...

CVE-2026-55040

Bypass dell'autenticazione JWT di Microsoft SharePoint CVE-2026-55040 Panoramica CVE-2026-55040.py è uno script proof-of-concept per sfruttare la vulnerabilità di bypass dell'autenticazione di SharePoint, CVE-2026-55040. Per un'analisi tecnica completa, consulta la nostra Analisi Rapid7. Utilizzo...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-50561

Summary: CVE-2026-50561 affects Yuxi prior to 0.6.2 where the Authorization header token is only authenticated for validity, not validated across deployments. This enables an administrator token from one deployment or local test environment to gain access to the backend management interfaces of a...

CVE-2023-27584

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

CVE-2023-33236

MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs...