61 matches found
CVE-2026-19278
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
CVE-2026-19278 Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
EUVD-2026-55617
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
CVE-2026-19278
CVE-2026-19278 concerns StackRox/RHACS Central. The flaw lies in the Auth Machine-to-Machine (M2M) token exchange where, during M2M role mapping, unanchored regular expressions are used to match claim values. This allows an attacker with a valid OpenID Connect (OIDC) token whose claim value is a ...
CVE-2026-19278
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
CVE-2026-19278: Permissive Regular Expression
A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...
CVE-2026-5855 Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read
Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...
CVE-2026-12771
A flaw was found in BerriAI litellm. A remote attacker can exploit an improper authorization vulnerability within the M2M JWT Handler. This could allow unauthorized access, leading to a low impact on the confidentiality, integrity, and availability of affected resources. Mitigation Mitigation for...
The vulnerability of the CoAP Handler Block1 in the open-source implementation of the LightWeight Machine-to-Machine (LwM2M) protocol, Eclipse Wakaama, allows a attacker to cause a service failure.
The vulnerability of the CoAP Block1 handler in the open-source implementation of the LightWeight Machine-to-Machine LwM2M protocol, Eclipse Wakaama, involves unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...
Server-side Request Forgery (SSRF)
Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /v1/mcp/test/connection endpoint. An attacker can perform server-side request forgery SSRF by supplying a crafted tokenurl and...
Incorrect Authorization
Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Authorization in the userapikeyauth.py file of the M2M JWT Handler. An attacker can gain unauthorized access to resources by exploiting insufficient authorization...
CVE-2026-12771 BerriAI litellm M2M JWT user_api_key_auth.py improper authorization
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...
CVE-2026-12771
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...
CVE-2026-12771
CVE-2026-12771 affects the litellm library by BerriAI up to version 1.82.2, specifically in litellm/proxy/auth/user_api_key_auth.py (M2M JWT Handler). The flaw enables improper authorization via remote exploitation with high attack complexity; public PoC exists. SNYK detaails identify the vulnera...
PT-2026-51186
Name of the Vulnerable Software and Affected Versions BerriAI litellm versions prior to 1.82.3 Description An issue in the M2M JWT Handler component, specifically within the file litellm/proxy/auth/user api key auth.py, leads to improper authorization. This flaw allows a remote attacker to bypass...
MINI-M2M4-H633-XWC2
Bulletin has no description...
Weak Authentication
Overview Affected versions of this package are vulnerable to Weak Authentication due to improper validation of oauthuserid in the TokenGuard::authenticateViaBearerToken function. An attacker can gain unauthorized access to unrelated user accounts by presenting a machine-to-machine token with a...
CVE-2026-39976
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier since there's no user. The token guard then passes this value ...
CVE-2026-39976: Improper Authentication
Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for clientcredentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier since there's no user. The token guard then passes this value ...
