11 matches found
CVE-2025-30144
요약 fast-jwt 라이브러리는 RFC https://datatracker.ietf.org/doc/html/rfc7519page-9 에 기반하여 iss 클레임을 제대로 검증하지 않습니다. 세부 사항 fast-jwt 라이브러리의 iss발급자 클레임 검증은 문자열 배열을 유효한 iss 값으로 허용합니다. 이 설계 결함으로 인해 악의적인 행위자가 'https://attacker-domain/', 'https://valid-iss' 형태의 iss 클레임을 가진 JWT를 제작하는 잠재적 공격이 가능해집니다. 허용적인 검증 때문에 해당...
CVE-2026-87785
Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...
CVE-2026-87785 Apache Syncope: JWT subject spoofing
Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...
CVE-2026-87785 Apache Syncope: JWT subject spoofing
Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...
PT-2026-91152
Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...
EUVD-2025-23514
Malicious code in bioql PyPI...
CVE-2025-44963
RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...
CVE-2025-44963
RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...
PT-2025-31827 · Ruckus · Ruckus Network Director
Name of the Vulnerable Software and Affected Versions: RUCKUS Network Director versions prior to 4.5 Description: RUCKUS Network Director RND is susceptible to an issue allowing an attacker to spoof an administrator JSON Web Token JWT if they possess knowledge of a hardcoded secret key...
CVE-2025-44963: Use of Hard-coded Cryptographic Key
RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...