CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — 임의 API 토큰 폐기로 인한 서비스 거부Denial of Service NVD • Advisory • CWE-639 개요 StudioCMS ≤ 0.3.0 의 DELETE /studiocmsapi/dashboard/api-tokens 엔드포인트는 editor 이상의 권한을 가진 모든 인증된 사용자가 다른 모든 사용자admin 및 owner 계정 포함의 API 토큰을 폐기할 수 있도록 허용합니다. 해당 핸들러는 토큰 소유권, 호출자 신원 또는 역할 계층 구조를 검증하지...

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

SummaryPyJWT 2.13.0 accepts compact JWS signature segments containing characters thatare not in the Base64URL alphabet. Appending !!!! to a valid signature doesnot change the decoded signature bytes or authenticated claims, but it changesthe serialized token and its SHA-256 hash. An application...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken이 계정 상태를 다시 검증하지 않음 Product: go-shiori/shiori File: internal/domains/auth.go CWE: CWE-613 — 불충분한 세션 만료 CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 높음 CNA: Turan Security · CVE 레코드 설명 Shiori의 CheckToken 함수internal/domains/auth.go는 JWT의 HMAC 서명만 검증하고 포...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269 PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-86473

The Apache Airflow Core API contains an insufficient session expiration vulnerability in the logout() endpoint located at airflow/api_fastapi/core_api/routes/public/auth.py. The endpoint only revokes session tokens presented as the _token cookie; if a client authenticates using an Authorization b...

CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-82761

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with singleusetoken?, which is the default, is meant to be...

CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

EEF-CVE-2026-78223 Token revocation record built from unverified JWT claims in AshAuthentication

Summary Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the...

CVE-2026-78223: Improper Verification of Cryptographic Signature

Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeTokenChange.change/3 reads the :token...

CVE-2026-85387

Concrete CMS before 9.5.4 contains an insufficient session expiration flaw in its OAuth REST API authorization validator. The validator confirmed only that a bearer token existed, had not expired, and had not been explicitly revoked, but did not re-check the account state of the token's owner. Co...

CVE-2026-82310

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-81921

Concrete CMS versions 8.5.3 through 9.5.2 are affected by an OAuth 2.0 refresh-token grant flaw. The unmodified upstream League grant issued new access tokens from a valid refresh token without re-checking the associated account's active status . Consequently, a user who obtained a refresh token ...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-86762

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

EUVD-2026-74939

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

PT-2026-89031

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-84203

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...