RS256-2-HS256

RS256-2-HS256 Attacco JWT per cambiare l'algoritmo da RS256 a HS256 Utilizzo root@kitploit: usage: RS2562HS256JWT.py -h payload pubkey positional arguments: payload Payload JSON del JWT da attaccare pubkey File della chiave pubblica da usare per la firma optional arguments: -h, --help mostra ques...

TokenBreaker

TokenBreaker Token Breaker è incentrato su 2 particolari vulnerabilità relative ai token JWT. None Algorithm RSAtoHMAC Fare riferimento a questo link per approfondimenti sulla vulnerabilità e su come un attaccante può falsificare i token Prova questa vulnerabilità qui Utilizzo di TheNone...

CVE-2026-15013

CVE-2026-15013 — miniOrange SAML SSO = 5.4.3 Authentifizierungs-Bypass PoC Proof-of-concept für CVE-2026-15013 : nicht authentifizierter Authentifizierungs-Bypass über Signaturalgorithmus-Verwechslung HMAC-SHA1 im miniOrange SAML Single Sign On – SSO Login WordPress-Plugin Versionen bis...

POC_CVE-2015-9235

CVE-2015-9235 Dimostrazione dell'attacco di confusione dell'algoritmo sulle librerie Json Web Token JWT. I JWT sono spesso usati nei cookie per certificare una sessione utente, quindi questo attacco è critico. Il modulo node [email protected] è stato utilizzato per dimostrare la vulnerabilit...

CVE-2023-48223

CVE-2023-48223 PoC fast-jwt Algorithm Confusion इस रिपॉजिटरी में fast-jwt में JWT algorithm confusion को दर्शाया गया है जब token verification allowed algorithms को lock नहीं करता। Environment Setup Requirements Node.js 18 या उससे नया npm OpenSSL आपके terminal PATH में उपलब्ध होना चाहिए 1 Install...

poc-cve-2016-10555

Cambiare l'algoritmo RS256 asimmetrico in HS256 simmetrico - POC CVE-2016-10555 L'algoritmo HS256 utilizza la chiave segreta per firmare e verificare ogni messaggio. L'algoritmo RS256 utilizza la chiave privata per firmare il messaggio e la chiave pubblica per l'autenticazione. Se si cambia...

ClaimJumper

root@kitploit: / | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Professionelles JWT-Sicherheitstest-Toolkit. Analysieren, knacken, fälschen und ausnutzen von JSON Web Tokens mit über...

BIT-KEYCLOAK-2026-11800 Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – Confusão de Algoritmo JWT via Injeção de kid Código do Programa servidor Node.js + exploit Python root@kitploit: // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient = require'jwks-rsa'; const...

CVE-2026-0265-check

CVE-2026-0265 Strumento di valutazione della vulnerabilità Determina in modo sicuro se un portale GlobalProtect di Palo Alto Networks PAN-OS è vulnerabile a CVE-2026-0265 senza autenticare alcuna sessione o modificare alcuno stato. Descrizione CVE-2026-0265 è un bypass di autenticazione remota ch...

CVE-2026-72889

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165

In Lemur 1.9.0 and earlier, lemur/auth/service.py:130-137 reads the alg field from an unverified JWT header and passes it to pyjwt.decode(..., algorithms=[header_data["alg"]]), letting an attacker choose the verification algorithm. PyJWT 2.x blocks alg=none, so direct ATO requires a separate LEMU...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch4 Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen whic...

CVE-2026-15013

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because MoSAMLUtilities::mosamlcastkey reads the SignatureMethod Algorithm attribute directl...

CVE-2026-15013

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because MoSAMLUtilities::mosamlcastkey reads the SignatureMethod Algorithm attribute directl...