jwt-hack

JSON Web Token 해킹 툴킷 JSON Web Token을 테스트, 분석 및 공격하기 위한 고성능 툴킷입니다. 설치 Cargo cargo install jwt-hack Homebrew brew install jwt-hack Snapcraft Ubuntu sudo snap install jwt-hack 소스에서 빌드 git clone https://github.com/hahwul/jwt-hack cd jwt-hack cargo install --path . Docker 이미지 GHCR docker pull...

FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

Cisco IOS XE WLC - Arbitrary File Upload

A vulnerability in the Out-of-Band Access Point AP Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system.This vulnerability is due to the presence of a hard-coded JSON Web...

CVE-2026-102265

A flaw was found in PyJWT. An unauthenticated remote attacker could trigger a Denial of Service DoS condition by supplying a specially crafted JSON Web Token JWT with deeply nested headers during decoding. Processing these nested structures causes an uncaught recursion error that bypasses standar...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.2.0

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 Vulnerability Details CVEID:CVE-2026-41710 DESCRIPTION: An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache ...

CVE-2026-78903-SWIFT-Kick-to-the-Creds

CVE-2026-78903 — SWIFT 認証情報へのキック SWIFT API Gateway JWT アルゴリズム混同 フィールド| 値 ---|--- 深刻度| 9.1（重大） ベクトル| ネットワーク 影響を受けるバージョン| 3.2.0 – 3.2.4 発見者| 𝕍𝕠𝕤𝕤🥷 説明 SWIFT API Gateway の重大な設定ミスにより、攻撃者はサーバーが RS256 を期待しているにもかかわらず、HS256 アルゴリズムを使用した JWT を作成できます。サーバーは公開 RSA 鍵を HMAC シークレットとして誤って検証するため、攻撃者は有効な管理トークンを偽造できま...

Astra Linux – Vulnerability in Ceph

A flaw was discovered in Red Hat Ceph Storage 4, within the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for documentation purposes, which again exposes them to...

EUVD-2026-42963

ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to JwtRequestCodeFilter copying security-sensitive claims from a signed request JWT into the authorization parameter map without proper validation, which allows an attacker with a validly signed JWT to replace...

NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)

The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...

Security Bulletin: Security Vulnerability in Nimbus Jose JWT Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-53864)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Nimbus Jose JWT Vulnerability Details CVEID:CVE-2025-53864 DESCRIPTION: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a...

EUVD-2026-55246

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65945

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65945

Apache Ranger versions

DEBIAN-CVE-2026-19017

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

EUVD-2026-54610

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

CVE-2026-19017 Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

CVE-2026-19017 Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

CVE-2026-19017

Removed by vendor...

CVE-2026-45414

Decidim CVE-2026-45414 describes a JWT binding flaw in multi-tenant deployments: a JWT issued for one organization can be replayed against another organization’s API to read participantDetails and access the proposal.answer mutation. Affected are pre-0.31.5 and 0.32.0.rc1 before 0.32.0.rc2; the i...