CVE-2025-9485

エクスプロイト: 署名なしJWTによる認証バイパス alg: none 1 管理者メールを主張する署名なしJWTを作成 root@kitploit: TOKEN=$node -e ' function b64us return Buffer.froms.toString"base64" .replace/+/g,"-" .replace///g,"" .replace/=+$/,"" const header = b64uJSON.stringify alg: "none", typ: "JWT" ; const now = Math.floorDate.now/1000; const...

CVE-2026-29000

CVE-2026-29000: pac4j JWT 認証バイパス PoC 概念実証 CVE-2026-29000 - pac4j JWT 実装における重大な認証バイパス脆弱性。攻撃者は有効な署名なしで管理者トークンを偽造できます。 ⚠️ 免責事項 このツールは教育目的および許可されたセキュリティテスト目的のみに提供されています。作者はこのエクスプロイトの誤用、損害、または違法使用について一切の責任を負いません。 コンピュータシステムへの不正アクセスはほとんどの法域で違法 です テスト前に明示的な書面による許可 を取得する必要があります...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-54733

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin localo365 Teams SSO endpoint ssologin.php base64-decodes a JWT payload and authenticates...

PYSEC-2026-2507 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

Summary The ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional co...

Exploit for CVE-2026-29000

CVE-2026-29000 – pac4j JWT Authentication Bypass Python PoC...

CVE-2026-1916

The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the wpgsicallBackFuncAccept and wpgsicallBackFuncUpdate REST API functions in all versions up to, and...

PT-2026-7129

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak’s invitation token registration mechanism. The server does not verify the cryptographic signature of the JSON Web Token JWT. An attacker can modify the organization...

📄 Confluence 8.x Privilege Escalation

Metasploit module proof of concept exploit that demonstrates an authentication bypass vulnerability Confluence version 8.x. ============================================================================================================================================= | Title : Confluence 8.x...

📄 Microsoft Sharepoint Authentication Bypass

This is a proof of concept exploit for a Microsoft Sharepoint authentication bypass vulnerability discovered in 2023. ============================================================================================================================================= | Title : SharePoint Authentication...

AZL-65996 CVE-2024-48916 affecting package ceph for versions less than 16.2.10-9

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

Microsoft Live Accounts Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Outlook Web Access OWA regarding a possible unsigned token. An attacker who successfully exploited this vulnerability could have access to another person's email inbox. To exploit this vulnerability, an attacker would first have to replace an...