CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main 未校验 JWT iss/aud 针对 Apache Camel 漏洞的可运行 PoC 复现工具：当未配置 jwtIssuer 或 jwtAudience 时，camel-main 内嵌 HTTP 服务器 仅凭密钥库构建其 JWT 认证器，因此入站令牌仅检查签名和过期时间 ——iss 和 aud 声明从未被校验。 运行时| 目录| 技术栈 ---|---|--- Camel Main （独立运行）| camel-main/| camel-main 4.21.0 +...

CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims registered audience aud, issuer iss, and expiry exp checkers but did not pass the mandatory claims list to...