The vulnerability of the /api/connections file of the JWT Refresh Token Handler software platform for automated file exchange with Cleo Harmony allows a malicious actor to escalate their privileges and gain unauthorized access to protected information.

The vulnerability of the /api/connections file of the JWT Refresh Token Handler component of the software platform for automated file exchange in Cleo Harmony is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges and gain...

CVE-2026-84115

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

EUVD-2026-69383

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

CVE-2026-84115

Cleo Harmony versions up to 5.8.1.10 are affected by an improper privilege management vulnerability in the JWT Refresh Token Handler component within the /api/connections file. Manipulation of the Bearer argument allows a remote, unauthenticated attacker to gain excessive privileges, with the sco...

CVE-2026-84115: Improper Privilege Management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

Linux Distros Unpatched Vulnerability : CVE-2026-82469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh toke...

CVE-2026-82469

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinit...

CVE-2026-82469 Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinit...

CVE-2026-82469 Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwtrefresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinit...

PT-2026-83449

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefini...

CVE-2026-41017 Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy

Apache Airflow's JWTRefreshMiddleware set the JWT auth cookie without the Secure flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default...

PT-2026-84292

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions 5.8.1.0 through 5.8.1.10 Description An issue exists in the JWT JSON Web Token refresh token handler within the /api/connections endpoint. A remote attacker can manipulate the Bearer argument in HTTP headers to bypass...