CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO 认证绕过 执行摘要 FortiCloud 单点登录（SSO）是注册任何 FortiGate/FortiManager/FortiAnalyzer 后默认启用的功能，其中包含一个严重的认证绕过漏洞。 任何拥有 FortiCloud 账户（免费或付费）的攻击者都可以复用其 SSO 令牌登录其他客户的设备（版本不高于下表所列），而无需知道对方的密码。 利用成功后，攻击者可获得完整的 admin GUI 和 root shell 访问权限，从而能够拦截流量、篡改 VPN 或横向移动进入内部网络。 请立即升级，或在修复前禁用...

CVE-2020-24030

CVE-2020-24030 描述 ForLogic Qualiex v1 和 v3 存在令牌过期机制薄弱的问题。这允许远程未认证攻击者通过令牌重用进行权限提升并访问敏感数据。 重要日期 公告（致供应商）：2020-07-12 公开披露日期：2020-08-31 漏洞类型 访问控制不当 产品供应商 ForLogic 受影响产品代码库 Qualiex - v1 Qualiex - v3 其他版本也可能受影响，尤其是同一系列（尚未测试） 受影响组件 Qualiex 攻击类型 远程 权限提升影响 是 信息泄露影响 是 攻击向量 授权令牌过期机制薄弱，允许重用令牌以获取权限并访问敏感数据...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — 元钓鱼（Meta-Phishing） Facebook Graph API — OAuth 令牌重用与会话劫持 字段| 值 ---|--- 严重性| 9.6（严重） 攻击向量| 网络 受影响版本| Graph API v18.0 – v20.0 发现者| 𝕍𝕠𝕤𝕤🥷 描述 Facebook Graph API 中存在一个严重漏洞，允许攻击者在多个会话中重用 OAuth 令牌。这可在无需用户交互的情况下实现会话劫持和账户接管。 技术细节 Graph API 未对 OAuth...

CVE-2025-56643

CVE-2025-56643 CVE-2025-56643 の公開リファレンス – Wiki.js 2.5.307 JWT セッション脆弱性 説明: Requarks Wiki.js 2.5.307 は、ユーザーがログアウトしたときにアクティブな JWT トークンを適切に取り消したり無効にしたりしません。 その結果、以前に発行されたトークンは有効なままであり、ログアウト後もシステムにアクセスするために再利用される可能性があります。 この動作はセッションの整合性に影響を与え、トークンが侵害された場合に不正アクセスを許す可能性があります。...

FOSKiller

root@kitploit: ███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║...

CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2026-76179

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

PT-2026-82791

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

CVE-2026-66908

Apache Camel Platform HTTP Main component (versions 4.8.0 through 4.21.x ) silently skipped validation of the iss and aud JWT claims when neither jwtIssuer nor jwtAudience was configured. The root cause is that JWTAuthenticationConfigurer.buildJwtOptions returned null, causing the Vert.x JWTAuth ...

CVE-2026-63408

In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-50561

Summary: CVE-2026-50561 affects Yuxi prior to 0.6.2 where the Authorization header token is only authenticated for validity, not validated across deployments. This enables an administrator token from one deployment or local test environment to gain access to the backend management interfaces of a...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-71468

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

CVE-2026-71468 Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...

EUVD-2026-56900

A flaw was found in acm-search-v2-api-rhel9. When the getFederationConfig function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub...