CVE-2026-19714

The Simple JWT Login WordPress plugin, in versions prior to 3.6.8 , is vulnerable to an unauthenticated account takeover due to a lack of audience validation for Google identity tokens. An attacker can exploit this by using a valid Google identity token to authenticate as any user associated with...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the OIDC authenticator. An attacker can gain access to the API by presenting a JWT that a shared identity provider issued for an unrelated service, because the token's audience aud claim is not validated. This...

PT-2026-50738

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.11.0 ZITADEL versions 3.0.0 through 3.4.11 Description An authentication bypass exists in the external JWT Identity Provider IdP implementation. While the system validates the cryptographic signature and the...

GHSA-QQCJ-RGHW-829X Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation

Context: A critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint /api/1.0/unity-control/auth/tokens. The endpoint extracts the issuer iss claim from incoming JWTs and uses it to dynamically fetch the JWKS endpoint for signature validation without...

Hono 授权问题漏洞

Hono is a web framework written in TypeScript from the Hono community. An authorization issue vulnerability exists in Hono versions 1.1.0 through prior to 4.10.2, which stems from the lack of built-in audience validation options in the JWT Auth Middleware, and could lead to token obfuscation and...