19232 matches found
PT-2026-129153
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name...
PT-2026-128290
Apache Kafka fixes 12 vulnerabilities, including CVE-2026-110985, which skips JWT signature verification and grants full cluster access. Patch now. ApacheKafka Kafka CVE2026110985 JWT OAuth DataStreaming DoS PatchNow https://t.co/65Yl7Wgz1k...
PMA-5.2.3-WebAuthn-2FA
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · PMA-5.2.3-WebAuthn-2FA PMA-5.2.3-WebAuthn-2FA phpMyAdmin 5.2.3 - phpMyAdmin Default tarball. web-auth/webauthn-lib is suggest / require-dev. composer install --no-dev does not install it. createServer therefore uses...
CVE-2025-65945-poc
CVE-2025-65945: node-jws Signature Bypass This is a proof of concept for a signature verification bypass in the node-jws library. The bug lets attackers forge valid JWTs when the server derives HMAC secrets from user-controlled data. What's the bug? The jws.createVerify function doesn't validate...
CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric oct key handling accepts an empty key empty bytes b'' / empty string '' as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so an attacker who knows or...
GHSA-8M4G-J4WP-WGCG Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric oct key handling accepts an empty key empty bytes b'' / empty string '' as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so an attacker who knows or...
EUVD-2026-88465
Authlib: empty signatures validation in JWS JSON deserialization...
GHSA-6V38-4H7W-RJ9H Authlib: empty signatures validation in JWS JSON deserialization
Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...
Authlib: empty signatures validation in JWS JSON deserialization
Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...
DEBIAN-CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-117601
Versions of Electrum before 4.8.3 are vulnerable to a flaw where the software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This allows malicious servers to replace a recently broadcast transaction with a conflicting one. An attacker can effectively
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...
CVE-2026-103325
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...
EUVD-2026-110632
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook notifications and mark arbitrary...