jwtear

Jwtear 一个模块化命令行工具，用于解析、创建和操作JSON Web Token（JWT）令牌，专为安全测试设计。 功能特点 完全模块化。 所有命令均为插件。 易于添加新插件。 支持JWS和JWE令牌。 插件接口简单易用（遵循模板示例）。 灵活 基于生产级库生成令牌（如json-jwt、jwe）。 可用插件 Parse：解析JWT令牌。 jws：操作和生成JWS令牌。 jwe：操作和生成JWE令牌。 bruteforce：暴力破解JWS签名密钥。 wiki：包含JWT离线信息、攻击思路、参考资料。 安装 自行安装： $ gem install jwtear 使用 显示主菜单 8888...

jwt-cracker

jwt-cracker 简单的 HS256、HS384 和 HS512 JWT 令牌暴力破解工具。 仅对弱密钥的 JWT 令牌有效。 建议 ：使用强长密钥或 RS256 令牌。 安装 通过 npm： npm install --global jwt-cracker 用法 通过命令行： jwt-cracker -t -a --max -d -f 其中： token ：要破解的完整 HS256-512 JWT 令牌字符串 alphabet...

DataEase < 2.10.10 - JWT Authentication Bypass

DataEase 2.10.10 contains a broken authentication caused by ineffective secret verification, letting users forge JWT tokens, exploit requires no special privileges. id: CVE-2025-49001 info: name: DataEase 2.10.10 - JWT Authentication Bypass author: YunSeoJo,aryu-ru severity: critical description:...

CVE-2026-100871

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-100871

Sylius versions before 1.12.25 , 1.13.17 , 1.14.20 , 2.1.16 , and 2.2.9 are vulnerable to a JWT audience confusion flaw. The application fails to include firewall identification in JWT tokens issued by the Admin and Shop API endpoints. An attacker can register a shop customer account using an adm...

CVE-2026-100871: Improper Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

JWT-Bruteforcer

JWT-Bruteforcer Herramienta básica de Jwt Bruteforcer con prueba de vulnerabilidad CVE-2018-1000531 Librerías importadas: jwt base64 Requiere versión mínima de python 3.6...

JShunter v0.8

JSHunter Professional JavaScript Security Analysis Tool Complete endpoint discovery, sensitive data detection, and advanced code analysis for security professionals About JSHunter is a comprehensive command-line tool for JavaScript security analysis and endpoint discovery. Built for security...

CVE-2026-82882: Missing Authorization

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

CVE-2026-65945: Insertion of Sensitive Information into Log File

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

PT-2026-59045

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of...

CVE-2026-58656: Use of GET Request Method With Sensitive Query Strings

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

Summary joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None. HMACAlgorithm.sign and HMACAlgorithm.verify in src/joserfc/rfc7518/jwsalgs.py:62-70 feed whatever OctKey.getopkey... produced into hmac.new..., and...

CVE-2026-50202 Steeltoe's static JWKS cache shared across schemes and never invalidated

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Security.Authentication.CloudFoundryBase prior to version 3.4.0, Steeltoe.Security.Authentication.JwtBearer prior to version 4.2.0, and...

CVE-2026-46496: Improper Neutralization of Input During Web Page Generation

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting XSS vulnerability exists in versions prior to 26.0.0 due to improper sanitization of the component. The component allows javascript: URIs in the source attribute, which are executed when the page is...

CVE-2026-49298

A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster e.g...

Apache Airflow: Auth manager doesn't invalidate JWT tokens after users click logout

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...

PYSEC-2026-187

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...

CVE-2026-48726

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for FabAuthManager and KeycloakAuthManager did not actually reach the underlying revoketoken call, so the JWT remained accepted by the API server...

CVE-2026-48726

A vulnerability exists in Apache Airflow where the logout flow for FabAuthManager and KeycloakAuthManager fails to reach the underlying revoke_token() call. Consequently, previously-issued JWT tokens remain valid and accepted by the API server until their natural expiry even after a user logs out...