CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : 개념 증명 CVE-2022-39227에 대한 개념 증명입니다. 이 CVE에 따르면 JSON 웹 토큰 검증에 결함이 있습니다. 유효한 토큰으로 수정된 클레임과 함께 서명을 재사용할 수 있습니다. 필요 사항: 1. 유효한 JSON 웹 토큰. 2. 백엔드가 python 라이브러리 "python-jwt" 버전 -i "=" 반환값: " ":"","protected":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",...

CVE-2026-29000

CVE-2026-29000 — pac4j-jwt JWE 認証バイパス pac4j-jwt ライブラリの JWE 認証脆弱性を研究するための CTF ラボ CVSS 9.3 Critical · CWE-287 · 影響: pac4j-jwt ← 管理パネルへアクセス ↓ 機密データを読み取り: 従業員リスト、システム設定、フラグ プロジェクト構成 CVE-2026-29000/ ├── lab/ ターゲット – Flask アプリ NexusBank Employee Portal │ ├── app.py 脆弱性のあるメインアプリケーション │ ├── Dockerfile...

kit-jwt

kit-jwt Kit 向けの JSON Web Token JWT エンコード / デコード TOC ファイル ファイル| 説明 ---|--- .editorconfig| エディタのフォーマット設定 .gitignore| ビルド成果物や依存関係用の Git 無視ルール .tool-versions| asdf ツールバージョン Zig, Kit LICENSE| MIT ライセンスファイル README.md| 本ファイル examples/basic.kit| 基本的な HS256 使用例 kit.toml| メタデータ、機能、依存関係を含むパッケージマニフェスト...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 are vulnerable to an authentication bypass due to the use of a hard-coded constant for JWT verification in the realtime WebSocket and SSE service . This flaw occurs specifically when the AISOC_REALTIME_JWT_SECRET environment variable is not configured. Unauthent...

EUVD-2026-89539

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2023-4696

CVE-2023-4696 memos v0.13.2에서 JWT 토큰의 부적절한 처리로 인한 계정 탈취 설명 최근 usememos/memos 시스템에서 발견한 중요한 보안 취약점을 조명하고자 합니다. 이 취약점은 모든 사용자가 다른 사용자의 데이터비밀번호 포함를 비교적 쉽게 수정할 수 있게 합니다. 이 결함을 악용하면 공격자가 승인되지 않은 접근 권한을 얻어 민감한 정보에 접근할 수 있으며, 이는 다양한 보안 및 개인정보 보호 문제를 야기합니다. 이 발견의 세부 사항을 살펴보겠습니다. 이 취약점의 핵심은 안전한 데이터 교환을 위해...

EUVD-2026-83263

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-14916

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...

BIT-CONTOUR-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-19505 RDK-B WebUI improper cryptographic signature verification vulnerability

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-50149: Improper Certificate Validation

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

EUVD-2026-61146

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

EUVD-2026-59757

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify key is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different...

CVE-2026-18500

CVE-2026-18500 concerns the @fastify/jwt plugin for Fastify. In versions before 10.2.2, a per-request key passed to request.jwtVerify({ key }) can be silently overridden by the plugin’s globally configured secret due to the option merge applying the global key last. This allows an ordinary authen...