49 matches found
CVE-2025-46345
Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue...
VulnCheck KEV: CVE-2024-36111
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string will be generated to overwrite the key in the configuration file when the...
CVE-2024-47073 Dataease arbitrary interface access vulnerability
DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...
Use Of Hard-coded Cryptographic Key
Dragonfly is vulnerable to Use of Hard-coded Cryptographic Key. The vulnerability is due to the use of a hardcoded secret key for JWT verification, allowing attackers to bypass authentication and perform actions with admin privileges. The issue is addressed in version 2.0.9, and users are advised...
Exploit for Authentication Bypass by Spoofing in Python-Jwt_Project Python-Jwt
CVE-2022-39227 CVE-2022-39227 : Proof of Concept Proof of co...
Node.js third-party modules: [authmagic-timerange-stateless-core] Improper Authentication
I would like to report Improper Authentication in authmagic-timerange-stateless-core It allows to forge user's identity. Module module name: authmagic-timerange-stateless-core version: 0.0.9 npm page: https://www.npmjs.com/package/authmagic-timerange-stateless-core Module Description Stateless an...
CVE-2019-1020015
graphql-engine aka Hasura GraphQL Engine before 1.0.0-beta.3 mishandles the audience check while verifying JWT...
