jwt-key-id-injector

Инжектор идентификатора ключа JWT Простой скрипт на Python для проверки гипотетической уязвимости JWT. Допустим, есть приложение, которое использует JWT-токены, подписанные алгоритмом HS256. Пример токена выглядит следующим образом:...

CVE-2026-65599: Cleartext Storage of Sensitive Information

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field intended only for a key identifier. Because JWT headers are Base64-encoded...

The vulnerability of the Dovecot mail server, related to errors in the encapsulation fields kid and azp in JWT tokens, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server is related to errors in the encapsulation of fields “kid” and “azp” in JWT tokens. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...