fwknop

fwknop - 단일 패킷 인증 SPA 소개 fwknop은 강력한 서비스 은닉을 위해 SPASingle Packet Authorization로 알려진 인증 방식을 구현합니다. SPA는 방화벽 뒤에서 기본적으로 패킷을 차단default-drop하는 상태에서 서비스에 대한 원하는 접근을 통신하기 위해 암호화되고 재전송이 불가능하며 HMAC을 통해 인증되는 단일 패킷만을 필요로 합니다. SPA의 주요 용도는 방화벽을 사용하여 SSH와 같은 서비스에 대한 모든 연결 시도를 차단함으로써 취약점0-day 및 패치되지 않은 코드 모두의 악...

connectwise-automate-AiTM-rce

ConnectWise Automate 중간자 공격 원격 코드 실행 목차 배경 타임라인 고찰 및 교훈 책임 있는 공개 PoC 코드 ConnectWise에 제공된 보고서 요약 취약한 구성 영향 기술적 세부 사항 1. HTTP 전송 2. 불충분한 프로토콜 보안암호화 및 검증 부재 2.1 종속성 확인 및 다운로드에 대한 불충분한 검증 2.2 재생 공격 방지 부재 2.3 자체 업데이트에 대한 불충분한 검증 3. RMM 명령 및 제어 탈취 완화 방안 배경 침투 테스트의 일환으로 ConnectWise Automate 원격 모니터링 및...

CVE-2026-100834

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834

The http4k library's Digest authentication module (org.http4k:http4k-security-digest ) is vulnerable in versions before 6.48.0.0 , 5.42.0.0 , and 4.51.0.0 . The root cause is that the nonceVerifier parameter in ServerFilters.DigestAuth and DigestAuthProvider defaults to { true }, meaning every no...

CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

http4k's Digest authentication module org.http4k:http4k-security-digest before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to true , so every nonce is accepted regardless of its value, age, or prior use...

CVE-2026-90997

Keycloak deployments in stateless mode with MySQL or MariaDB are affected by a replay protection bypass caused by a mismatch in row-count semantics between the database driver and Keycloak's application logic. An attacker who intercepts single-use security artifacts—such as JWT client assertions ...

CVE-2026-90997 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

EUVD-2026-79236

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

CVE-2026-12704

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and ga...

PT-2026-76559

Name of the Vulnerable Software and Affected Versions Nimiq versions prior to 1.5.1 Description The validity store uses a strict lower-bound comparison that expires stored transactions too early relative to the Transaction::is valid at function. This occurs because the store treats a transaction...

Insufficient Verification of Data Authenticity

Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the JwtRequestCodeFilter process. An attacker can override security-sensitive parameters such as codechallenge,...

CVE-2026-63687

A security bypass vulnerability exists in Apache CXF within the cxf-rt-rs-security-oauth2 component. The JwtRequestCodeFilter fails to exclude security-sensitive parameters when copying claims from a signed request JWT into the authorization parameter map. An attacker who possesses or compromises...

CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

EUVD-2026-53860

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

MGASA-2026-0323 Updated tomcat packages fix security vulnerabilities

The updated packages fix security vulnerabilities: XSS in number guess example. CVE-2026-50229 Bad ornext processing in RewriteValve. CVE-2026-53404 Invalid CRL configuration doesn't trigger failure for FFM Connector. CVE-2026-53434 Logged effective web.xml is incomplete. CVE-2026-55276...

CVE-2026-66883 Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

EUVD-2026-52658

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...