CVE-2026-29000

CVE-2026-29000 — Bypass de autenticación JWE en pac4j-jwt Laboratorio CTF para investigar la vulnerabilidad de autenticación JWE en la librería pac4j-jwt CVSS 9.3 Crítico · CWE-287 · Afecta: pac4j-jwt ← acceso al panel de administración ↓ Leer datos sensibles: lista de empleados, configuración de...

CVE-2023-4696

CVE-2023-4696 memos v0.13.2 における JWT トークンの不適切な処理によるアカウント乗っ取り 説明 私は最近、usememos/memos システムにおいて重大なセキュリティ脆弱性を発見しました。この脆弱性により、任意のユーザーが他のユーザーのデータ（パスワードを含む）を比較的容易に変更できる可能性があります。この欠陥を悪用することで、攻撃者は機密情報への不正アクセスを取得し、多くのセキュリティおよびプライバシー上の懸念を引き起こす可能性があります。この発見の詳細を見ていきましょう。 この脆弱性の核心は、安全なデータ交換に一般的に使用されるメカニズムである...

CVE-2026-14916

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...

kit-jwt

kit-jwt Kit 向けの JSON Web Token JWT エンコード / デコード TOC ファイル ファイル| 説明 ---|--- .editorconfig| エディタのフォーマット設定 .gitignore| ビルド成果物や依存関係用の Git 無視ルール .tool-versions| asdf ツールバージョン Zig, Kit LICENSE| MIT ライセンスファイル README.md| 本ファイル examples/basic.kit| 基本的な HS256 使用例 kit.toml| メタデータ、機能、依存関係を含むパッケージマニフェスト...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : 概念验证 此 CVE-2022-39227 的概念验证代码。根据该CVE，JSON Web Token验证存在缺陷。可以通过有效的令牌，利用其签名与修改后的声明一起使用。 所需条件： 1. 一个有效的JSON Web Token。 2. 后端使用的是版本低于 3.3.4 的 Python 库 "python-jwt"。 为了方便使用，我在一次CTF中编写了一个简单的PoC： root@kitploit: usage: CVE-2022-39227-PoC -h -j TOKEN -i CLAIM Proof of Conce...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-18500

CVE-2026-18500 concerns the @fastify/jwt plugin for Fastify. In versions before 10.2.2, a per-request key passed to request.jwtVerify({ key }) can be silently overridden by the plugin’s globally configured secret due to the option merge applying the global key last. This allows an ordinary authen...

CVE-2026-59243

The CVE-2026-59243 vulnerability affects the apache-airflow-providers-fab package before 3.7.3, where the FAB auth manager’s Azure AD OAuth login defaulted verify_signature=False when decoding the ID token. An attacker who can present a forged or unsigned (alg:none) ID token to the OAuth callback...

Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT i...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to PyJWT

Summary PyJWT is used by IBM Cloud Pak for Data System 1.0 as a Python library for encoding and decoding JSON Web Tokens JWT for authentication and authorization. Multiple vulnerabilities affect PyJWT. CVE-2026-48522 involves a Server-Side Request Forgery SSRF vulnerability where PyJWKClient pass...

CVE-2026-45363

CVE-2026-45363 affects the ruby-jwt gem (Ruby implementation of JWT). Prior to versions 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') can accept attacker-forged tokens because OpenSSL::HMAC.digest('SHA256', '', payload) yields a valid digest with an empty key, and empty-key pa...

CVE-2026-45069

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims registered audience aud, issuer iss, and expiry exp checkers but did not pass the mandatory claims list to...

EUVD-2026-37897

Woodpecker gRPC agentid metadata can be spoofed- cross-tenant agent impersonation...

GHSA-G3XR-5W5J-W4Q4 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Impact When an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuration. Consequently, requests from clients that do not send TLS SNI or send an unrecognized SN...

PT-2026-55460

Name of the Vulnerable Software and Affected Versions Contour versions prior to 1.33.5 Description An issue exists when an HTTPProxy is configured with both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders. In this scenario, the system fails to reject the...

PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

!NOTE The library does not directly return non-HTTPS URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws attacker write access to a filesystem path, untrusted jku derivation that this fix do...

EUVD-2026-32927

Hono: JWT middleware accepts any Authorization scheme, not only Bearer...

CVE-2026-47673

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds t...