PT-2025-40251

Name of the Vulnerable Software and Affected Versions Kazaar version 1.25.12 Description The software allows a JSON Web Token JWT with 'none' specified in the 'alg' field. This can potentially compromise the integrity of the authentication process. Recommendations At the moment, there is no...

CVE-2025-59686

Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...

CVE-2025-59685

Kazaar 1.25.12 allows a JWT with none in the alg field...

CVE-2025-59685

CVE-2025-59685 affects Kazaar 1.25.12, where a JSON Web Token (JWT) with alg: none can be accepted, potentially enabling authentication bypass. The NVD entry lists CVSSv3.1 base score 5.3 (Medium) with network attack vector, low attack complexity, no privileges required, and no user interaction. ...