CVE-2026-25050

CVE-2026-25050 – Authentication Timing Attack This repository contains a Proof of Concept demonstrating a timing attack affecting the NativeAuthenticationStrategy.authenticate method. This PoC is provided as a technical demonstration for blog / research purposes. Vulnerability The authentication...

Bcrypt-forcer

Bcrypt-forcer sqlmap Bcrypt decryption tool Bcrypt hash cracker...

CVE-2026-8794

CVE-2026-8794 — Username Enumeration via Authentication Timing Side-Channel in PaperCut NG Field| Details ---|--- CVE ID| CVE-2026-8794 Product| PaperCut NG Affected Version| 25.0.11 Build 75758 and earlier CWE| CWE-208 — Observable Timing Discrepancy CVSS Score| 3.7 Low — standalone; escalates...

hmac-bcrypt

hmac-bcrypt This repository contains reference implementations of the hmac-bcrypt password hashing function in several languages. Each reference implementation attempts to be a 1:1 port of the original C and Perl implementations created by @epixoip where possible, and are fully compatible with ea...

HTB-Pterodactyl-Writeup

HackTheBox — Pterodactyl Writeup Difficulty: Medium | OS: Linux openSUSE Leap 15.6 | Season: 10 Summary Pterodactyl is a medium-difficulty Linux machine running the Pterodactyl game server panel. The attack chain involves an unauthenticated LFI-to-RCE vulnerability in the panel, credential...

hello-ReGrade-security

hello-ReGrade-security A hands-on demo of zero-day discovery withReGrade. You'll point an ordinary test suite at ReGrade, record it against a tiny service, replay it against a second copy of the same service , and use Claude Code + the ReGrade MCP tools to surface a password-hash leak — a...

xbootEncodePwd

xbootEncodePwd xboot-activiti-1.0-SNAPSHOT xboot-cms-1.0-SNAPSHOT xboot-generator-1.0-SNAPSHOT xboot-app-1.0-SNAPSHOT xboot-core-1.0-SNAPSHOT xboot-open-1.0-SNAPSHOT xboot-autochat-1.0-SNAPSHOT xboot-docking-1.0-SNAPSHOT xboot-quartz-1.0-SNAPSHOT xboot-base-1.0-SNAPSHOT xboot-ems-1.0-SNAPSHOT...

Win32_Hash

win32hash Password hashing and verification for Windows, written in Ada/SPARK. It derives a hash with PBKDF2-HMAC-SHA256 through the Windows CNG API bcrypt, generates a random salt, stores it as Base64, and wipes every secret it touches. Almost all of the code is proved with GNATprove; the few...

cve-2022-22976-bcrypt-skips-salt

BCrypt Hash Check To assist with the mitigation steps for CVE-2022-xxxx, you can use this tool to check your database for hashes that need updating. After you've integrated the application with your database, the tool works in two steps. To demonstrate this a in-memory sample application is used...

CVE-2026-111723

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

EUVD-2026-103015

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

CVE-2026-111723 LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

CVE-2026-111723 LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

CVE-2026-111723

The LingGuo-Drama software (through commit 8a6924a ) contains a Broken Access Control vulnerability (CWE-862) in the /admin/v1/admins API. The root cause is a missing authorization check where the API is only protected by AuthAdminJWT , allowing any registered user to perform administrative actio...

CVE-2026-111723: Missing Authorization

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap...

PT-2026-116122

Name of the Vulnerable Software and Affected Versions LingGuo-Drama versions prior to commit 8a6924a Description An authorization flaw allows any registered user to manage all accounts via the '/admin/v1/admins' API endpoint, which is only protected by AuthAdminJWT. This allows attackers to...

CVE-2026-63158

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAPLOG/AGORAPPASS cookie mechanism treating the...

CVE-2026-63158

The Omnispace Agora Project (versions before 26.10.0 ) is vulnerable to an authentication bypass via a Pass-the-Hash attack. The root cause is the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism, which incorrectly treats stored bcrypt password hashes as replayable bearer credentials. An attacker w...

CVE-2026-110217

Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashes via GET /chat/hrs. Low-privileged operators can collect administrator password hashes, phone numbers, and addresses from the...

CVE-2026-110217

The Lenve vhr application (through commit 03abbd3 ) contains an information disclosure vulnerability. This flaw allows any authenticated user to access other operators' BCrypt password hashes by sending a GET request to the /chat/hrs endpoint. Specifically, low-privileged operators can retrieve s...