cve-2025-29927

CVE-2025-29927-PoC-Exploit Next.js 미들웨어의 인증 우회 개념 증명Proof-of-Concept 취약한 버전에 대해 실행할 수 있습니다: https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927 실행 실행 방법은 간단합니다. 1. Python3 CVE-2025-29927-PoC-Exploit.py 도메인 이름을 입력하라는 메시지가 표시됩니다. 두 가지 옵션이 있습니다: 첫째, 도메인 이름만 입력. 둘째, 경로를 포함한 도메인 이름...

CVE-2025-29927

CVE-2025-29927 - Next.js 미들웨어 권한 부여 우회 PoC 이는 Next.js 미들웨어 권한 부여 우회 취약점CVE-2025-29927에 대한 CTFCapture The Flag 스타일의 개념 증명PoC입니다. 목표는 인증 미들웨어를 우회하여 /protected 라우트에서 플래그를 획득하는 것입니다. 취약점 요약 CVE : CVE-2025-29927 유형 : 권한 부여 우회 구성 요소 : Next.js 미들웨어 영향 : 보호된 라우트에 대한 무단 접근 PoC 대상 라우트 : /protected 예상 동작 : ...

nextjs-vulnerable-app

Next.js 인증 앱 NextAuth.js를 사용하여 인증을 구현하는 Next.js 애플리케이션입니다. 이 앱은 특정 페이지에 접근하려면 사용자 인증이 필요한 보호된 경로protected routes를 제공합니다. 프로젝트 구조 root@kitploit: nextjs-auth-app ├── components │ ├── Layout.js Layout component for consistent structure │ ├── Navbar.js Navigation bar component │ └── ProtectedRoute.js...

CVE-2025-29927-Nextjs-Analysis

CVE-2025-29927 Next.js 분석 이 저장소는 Docker에서 CVE-2025-29927을 분석하기 위해 만든 자체 호스팅 Next.js 랩 환경을 포함합니다. 개요 CVE-2025-29927은 Next.js 미들웨어에 구현된 권한 부여 검사와 관련된 취약점입니다. 이 프로젝트는 통제된 환경에서 미들웨어로 보호되는 라우트 동작을 관찰하기 위한 로컬 랩으로 구축되었습니다. 문서 분석 보고서: docs/CVE-2025-29927-Analysis-Report.md 스크린샷: docs/images/ PoC 스크립트:...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ServeHTTP function in pkg/middlewares/replacepathregex/replacepathregex.go, which forwards the post-substitution path to the backend without checking whether it normalizes to a different route. An attacker can...

GHSA-X27W-589X-FRM2 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

CVE-2026-56679

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...

CVE-2026-56679

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...

CVE-2026-56679 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...

CVE-2026-56679

9Router (AI router & token saver) contains a mass-assignment vulnerability in PATCH /api/settings prior to version 0.5.4. The endpoint writes the entire request body to persistent settings without a field whitelist, enabling an authenticated user to modify security-critical fields such as require...

CVE-2026-48489

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...

CVE-2026-48489

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated...

CVE-2026-48489

CVE-2026-48489 (Symfony) : A logic flaw in the DefaultAuthenticationFailureHandler with failure_forward enabled allowed an unauthenticated login failure to dispatch a subrequest to access_control-protected GET routes, bypassing firewall listeners. This affected Symfony versions prior to 5.4.53, 6...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to missing authentication checks for the /codex endpoint, where requests bypass the API key validation before being rewritten to protected API routes, allowing unauthenticated attackers to invoke upstream LLM provider APIs...

Improper Authentication

Apache Camel is vulnerable to Improper Authentication. The vulnerability is due to missing authentication for critical functions, where the KeycloakSecurityPolicy defaults to not verifying the access token, and an invalid token is accepted, allowing unauthenticated access to protected routes...

CVE-2026-59731

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI operation and can resolve the request to a...

CVE-2026-53913 Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely 'Failing Open' vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess, which performs three checks ...

CVE-2026-49468

A flaw was found in LiteLLM, a proxy server AI Gateway used to call Large Language Model LLM APIs. A remote attacker could exploit a Host-header parsing vulnerability in the proxy authentication layer. By sending a crafted Host header, an attacker could gain unauthenticated access to protected...

CVE-2026-48020

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a...

PT-2026-50152

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.84.0 Description A Host-header parsing flaw in the LiteLLM proxy allows unauthenticated access to protected management routes. The authentication layer derives the effective route from request.url.path in the get...