CVE-2026-29000

CVE-2026-29000 Exploit Generator Rust This repository contains a specialized Rust implementation for exploiting CVE-2026-29000, an authentication bypass vulnerability in pac4j-jwt. The vulnerability stems from a "Signature Validation Skip" when a PlainJWT alg: none is nested within an encrypted J...

deny-af-alg-bpf

deny-af-alg-bpf Description BPF LSM program that blocks AFALG Linux kernel crypto API socket creation and logs all attempts via a ring buffer to userspace. What it does Attaches to the lsm/socketcreate hook Denies any socketAFALG, ... call with -EPERM Emits structured events pid, comm to a BPF ri...

cve-2022-27255

CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow This repository contains the materials for the talk "Exploring the hidden attack surface of OEM IoT devices: pwning thousands of routers with a vulnerability in Realtek’s SDK for eCos OS.", which was presented at DEFCON30. The contents of...

slipstream

NAT Slipstreaming NAT Slipstreaming allows an attacker to remotely access any TCP/UDP service bound to any system behind a victim's NAT, bypassing the victim's NAT/firewall remote arbitrary firewall pinhole control, just by the victim visiting a website. v1 developed by : @SamyKamkar //...

CVE-2026-29000

CVE-2026-29000: pac4j JWT Authentication Bypass PoC Proof of Concept for CVE-2026-29000 - A critical authentication bypass vulnerability in pac4j JWT implementation that allows attackers to forge admin tokens without a valid signature. ⚠️ DISCLAIMER This tool is provided for educational and...

jwt_tool

The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...

CVE-2026-29000

JWT/JWE Authentication Bypass PoC A Proof-of-Concept PoC script demonstrating an authentication bypass vulnerability using JSON Web Tokens JWT and JSON Web Encryption JWE. This tool exploits environments that improperly validate token algorithms by accepting unverified JWTs alg: none wrapped insi...

CVE-2026-45156-POC

Hacker Matrix Glitch 🚨 CVE-2026-45156 🚨 Nextcloud useroidc ID4me JWT Signature Bypass Fully Automated Proof of Concept PoC Exploit for Admin Takeover. 📖 The Story Behind every CVE, there's a story. This one was found at 2 AM on a cold winter night, fueled by a breakup mashup on loop. Read the ful...

CVE-2026-29000-pac4j-jwt

pac4j-jwe-forge CVE-2026-29000 Proof-of-concept for CVE-2026-29000. Targets pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability is straightforward: the library accepts a PlainJWT unsigned, alg=none as long as it's wrapped inside a valid JWE. Since the server exposes its RSA...

CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2026-89316

The LoadPublicKey function is vulnerable to a panic due to an unchecked type assertion: algToOptsMap[alg].(*ECDSAOptions). This occurs when a JSON Web Key (JWK) contains a "kty" value of "EC" paired with a non-EC "alg" algorithm, a combination permitted by RFC 7517 §4.4 . The issue is associated ...

PT-2026-115401

Name of the Vulnerable Software and Affected Versions Customer Email Verification for WooCommerce versions prior to 3.3.1 Description This issue allows unauthenticated attackers to gain authentication as any unverified WordPress account, including those with administrator privileges. The flaw...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: af-alg – Fix NULL pointer dereference in scatterwalk The AFALG interface fails to unmark the end of a Scatter/Gather List SGL when chaining a new afalgtsgl structure. If a sendmsg function fills an SGL exactly up to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: afalg – Zero initialize memory allocated via sockkmalloc Several crypto user API contexts and requests that were allocated using sockkmalloc remained uninitialized. This meant that callers had to explicitly set the fields...

jwt_tool

El kit de herramientas JSON Web Token v2 jwttool.py es un kit de herramientas para validar, forjar, escanear y manipular JWTs JSON Web Tokens. Su funcionalidad incluye: Comprobar la validez de un token Probar exploits conocidos: CVE-2015-2951 La vulnerabilidad de omisión de firma alg=none...

UBUNTU-CVE-2026-71892

In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients, org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidationtrue, never ran for a message using RFC 9709 content-encryption key derivation id-alg-cek-hkdf-sha256. The branch that should...

CVE-2026-59163

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-59163

Mnemosyne is a memory layer for AI agents. Prior to v3.10.1 , the authentication check in mnemosyne/core/sync_server.py parsed the JWT header and payload via base64 decoding and then passed the token to a jwt library call with options that effectively disabled signature verification , allowing th...