3333 matches found
python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access
A flaw was found in PyJWT, a Python library for handling JSON Web Tokens JWT. An attacker with control over a registered JSON Web Key JWK private key can bypass security checks by signing a token with a forbidden algorithm while claiming to use an allowed one. This allows the attacker to have the...
Xalgorix Autonomous AI Pentesting Agent 4.5.55
Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...
Improper Restriction of Communication Channel to Intended Endpoints
Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Improper Restriction of Communication Channel to Intended Endpoints via the AI Agents MCP verifier in packages/cli/src/modules/agents/builder/agents-builder-tools.service.ts. An attacker can send th...
rekor-log-verifier (0.1.0) potentially affected by CVE-2026-24408 via sigstore (3.6.5)
sigstore PYPI version 3.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on sigstore and may be impacted: - rekor-log-verifier 0.1.0 Source cves: CVE-2026-24408 Source advisory: OSV:PYSEC-2026-1924...
nv-attestation-sdk (>=1.4.0, <=2.7.3), nv-local-gpu-verifier (>=2.0.0, <=2.7.3) +1 more potentially affected by CVE-2025-48994 via signxml (3.2.0)
signxml PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - nv-attestation-sdk =1.4.0, =2.0.0, =1.0.0, =1.7.3 Source cves: CVE-2025-48994 Source advisory: OSV:PYSEC-2026-1921...
nv-attestation-sdk (>=1.4.0, <=2.7.3), nv-local-gpu-verifier (>=2.0.0, <=2.7.3) +1 more potentially affected by CVE-2025-48995 via signxml (3.2.0)
signxml PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - nv-attestation-sdk =1.4.0, =2.0.0, =1.0.0, =1.7.3 Source cves: CVE-2025-48995 Source advisory: OSV:PYSEC-2026-1922...
CVE-2026-46455
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks... with only the subject-exists check and the realm-URL issuer check. Keycloak's...
CVE-2026-46455
The Apache Camel Keycloak Component contains an insufficient session expiration vulnerability (CWE-613 , CWE-287 ) in the KeycloakSecurityHelper.parseAndVerifyAccessToken method. The root cause is the omission of the IS_ACTIVE predicate when building the TokenVerifier. While the helper validates ...
CVE-2026-46455
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks... with only the subject-exists check and the realm-URL issuer check. Keycloak's...
CVE-2026-46455 Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks... with only the subject-exists check and the realm-URL issuer check. Keycloak's...
PT-2026-55890
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x Description Insufficient session expiration in the Apache Camel Keycloak Component occurs because the KeycloakSecurityHelper.parseAndVerifyAccessToken...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass due to improper enforcement of the PKCE S256 challenge during the OAuth2 token exchange process. An attacker can obtain access tokens without providing the expected code verifier by bypassing the intended...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass due to improper enforcement of the PKCE S256 challenge during the OAuth2 token exchange process. An attacker can obtain access tokens without providing the expected code verifier by bypassing the intended...
Gitea OAuth2 PKCE S256 verifier bypass
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
GHSA-M5CH-PPFX-XV3V Gitea OAuth2 PKCE S256 verifier bypass
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-26247
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-26247 Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...
CVE-2026-26247
Gitea versions prior to 1.25.5 are vulnerable to an Access Control Bypass because they fail to correctly persist the OAuth2 PKCE S256 challenge method during authorization. This flaw allows an attacker to bypass the intended verification step and obtain access tokens without providing the expecte...
CVE-2026-26247 Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check...