10 matches found
CVE-2026-53709
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...
CVE-2026-53709
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...
CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...
EUVD-2026-98769
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...
CVE-2026-53709
Versions prior to 1.0.2 of MCP Context Forge are vulnerable to administrative token forgery due to a hard-coded JWT_SECRET_KEY shipped in mcpgateway/config.py and .env.example. The verify_jwt_token() function accepts HS256 tokens signed with this known key, and get_current_user() automatically cr...
CVE-2026-53709: Improper Authentication
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...
CVE-2026-50561: Improper Authentication
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...