poc-cve-2016-10555

将算法从 RS256（非对称）改为 HS256（对称）- POC（CVE-2016-10555） HS256 算法使用密钥来签名和验证每条消息。 RS256 算法使用私钥签名消息，并使用公钥进行身份验证。 如果将从 RS256 改为 HS256，后端代码将把公钥作为密钥，然后使用 HS256 算法验证签名。 致谢： https://www.youtube.com/c/FarahHawa...

NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.0, = 6.2.4...

CVE-2026-107722

The fast-jwt library (versions 6.2.0 to 6.3.0 ) is vulnerable to RSA→HS256 algorithm confusion due to an incomplete patch of CVE-2026-34950. The root cause resides in src/crypto.js, where performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored. This allows...

CVE-2026-107722 fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

EUVD-2026-95347

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

RS256-2-HS256

RS256-2-HS256 将算法从RS256更改为HS256的JWT攻击 用法 usage: RS2562HS256JWT.py -h payload pubkey positional arguments: payload JSON payload from JWT to attack pubkey Public key file to use for signing optional arguments: -h, --help show this help message and exit 示例...

TokenBreaker

TokenBreaker Token Breaker 专注于与 JWT 令牌相关的两个特定漏洞。 None 算法 RSA 到 HMAC 有关漏洞的详细说明以及攻击者如何伪造令牌，请参考 此处 的链接。 在此 尝试 该漏洞。 TheNone 用法 usage: TheNone.py -h -t TOKEN TokenBreaker: 1.TheNoneAlgorithm optional arguments: -h, --help show this help message and exit required arguments: -t TOKEN, --token TOKEN JWT...

CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 Bypass de Autenticación PoC Prueba de concepto para CVE-2026-15013 : bypass de autenticación no autenticado mediante confusión de algoritmo de firma SAML HMAC-SHA1 en el plugin de WordPress SAML Single Sign On – SSO Login de miniOrange versiones hasta ...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | | |,| || | | ||/ | ,| | || | | ./ || |/ | | || v0.1.0 Kit profesional de pruebas de seguridad para JWT. Analiza, descifra, falsifica y explota JSON Web Tokens con más de 15...

CVE-2026-0265-check

CVE-2026-0265 漏洞评估工具 安全地判断 Palo Alto Networks PAN-OS GlobalProtect 门户是否易受 CVE-2026-0265 影响，无需认证任何会话或修改任何状态。 描述 CVE-2026-0265 是一个影响 PAN-OS 和 Panorama 的远程认证绕过漏洞，当认证配置文件使用云认证服务 CAS 时触发。libpanmpmp.so 中存在漏洞的 panauthverify 函数完全根据攻击者控制的 alg 头部分派 JSON Web Token 签名验证——一个伪造的 JWT，其 alg=HS256 且签名为...

CVE-2026-85394

A flaw was found in python-jose. A remote attacker who obtains the service's public key can exploit an algorithm confusion vulnerability when signature verification algorithms are not strictly restricted. By utilizing a specifically formatted public key as a shared secret key, the attacker can...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – Confusión de algoritmo JWT mediante inyección de kid Código del programa servidor Node.js + exploit en Python // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient = require'jwks-rsa'; const axios...

CVE-2026-78903-SWIFT-Kick-to-the-Creds

CVE-2026-78903 — SWIFT Kick to the Creds Confusión de algoritmo JWT en SWIFT API Gateway Campo| Valor ---|--- Severidad| 9.1 Crítica Vector| Red Versiones afectadas| 3.2.0 – 3.2.4 Descubierto por| 𝕍𝕠𝕤𝕤🥷 Descripción Una configuración incorrecta crítica en SWIFT API Gateway permite a un atacante...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 — WSO2 El mecanismo de autenticación JWT acepta tokens firmados con algoritmos distintos de los configurados o soportados explícitamente. Esto permite a un atacante crear un JWT con un...

POC_CVE-2015-9235

CVE-2015-9235 演示针对 JSON Web Token JWT 库的算法混淆攻击。JWT 通常用于 Cookie 中认证用户会话，因此该攻击至关重要。使用 Node 模块 [email protected] 来展示此漏洞。 该项目也是一次愉快的 vibe coding 活动，因为前端（除 API 调用外）几乎完全由 LLM 完成。 漏洞 JWT 的格式如下： b64header.b64payload.b64signature 在我们的场景中： header = algorithm, type payload = username, role 在当时，各种 JWT...

CVE-2023-48223

CVE-2023-48223 PoC Confusión de Algoritmos fast-jwt Este repositorio demuestra la confusión de algoritmos JWT en fast-jwt cuando la verificación del token no bloquea los algoritmos permitidos. Configuración del Entorno Requisitos Node.js 18 o más reciente npm OpenSSL debe estar disponible en tu...

cve-2026-102268-poc

CVE-2026-102268 — Bypass de detección de PEM asimétrico en PyJWT Resultado del análisis de explotabilidad: la causa raíz está confirmada y la explotación de extremo a extremo es reproducible. Una clave pública PEM mutada con espacios en blanco elude la comprobación ispemformat de PyJWT y se acept...

Exploit for CVE-2026-102268

CVE-2026-102268 — PyJWT Asymmetric-PEM Detection Bypass E...

PyJWT accepts public JWK containers as HMAC secrets

SummaryPyJWT 2.13.0 contains an incomplete defense against algorithm confusion whenan application mixes symmetric and asymmetric algorithms in one verificationpath. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when itis wrapped in a JWKS object, nested in an array, or represente...

PyJWT BOM Bypass

Affected Package- Package: PyJWT pyjwt on PyPI- Repository: https://www.google.com/url?q=https://github.com/jpadilla/pyjwt=gmail=1781794518474000=E- Affected version: 2.13.0- Vulnerability class: Algorithm confusion / patch bypass--- Root CausePyJWT 2.13.0 introduced a guard in...