PYSEC-2026-3990

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

CVE-2026-82355 Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation

When a request to the Airflow core API carries both a session cookie and an explicit Authorization: Bearer token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the...

PT-2026-96121

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.2 Description The Core API logout endpoint only revokes session tokens provided via the token cookie. If a client uses an Authorization bearer header for authentication during logout, the endpoint returns a...

CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-73418: Improper Input Validation

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

PT-2026-65643

Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...

GHSA-XMF8-CVQR-RFGJ Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Summary The exported getToken helper next-auth/jwt and @auth/core/jwt can throw an uncaught exception when it reads a malformed Authorization: Bearer … header. When no session cookie is present, getToken URL-decodes the bearer value before validating it, and malformed percent-encoding causes the...

Improper Check for Unusual or Exceptional Conditions

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sending...

Malicious code in chai-deflect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4328eb627063ce40813ae27e3cb7ec1a967d17aa6c2bf045f0083d42e09352ea On require'chai-deflect', index.js top-level invokes launchDeflectBootstrap which detaches a child process running lib/caller.js. caller.js issues an...

CVE-2026-9803

A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an...

Hono 授权问题漏洞

Hono is a web framework built with TypeScript in the Hono community. Versions of Hono prior to 4.12.21 had an authorization issue vulnerability. This vulnerability stemmed from the jwt and jwk middleware not verifying the Authorization header values using the Bearer scheme. As a result, JWT...

PT-2026-44196

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the ClientRegistrationAuth component allows a remote unauthenticated attacker to cause a Denial of Service DoS. By sending a specially crafted POST request with a malformed...

CVE-2026-45339

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-...

Keycloak < 26.5.4 Multiple Vulnerabilities

Keycloak versions installed prior to 26.5.4 are affected by multiple vulnerabilities, including: - The Keycloak Authorization header parser is overly permissive regarding the formatting of the 'Bearer' authentication scheme. It accepts non-standard characters such as tabs as separators and...

CVE-2026-0707

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters such as tabs as separators and tolerates case variations that deviate from RFC 6750 specifications...

CVE-2026-0707

CVE-2026-0707 affects Keycloak’s Authorization header parser, which is overly permissive with the Bearer scheme. The vulnerability accepts non-standard separators (e.g., tabs) and tolerates case variations that deviate from RFC 6750, enabling potential authentication handling bypasses. Public sou...

CVE-2026-0707

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters such as tabs as separators and tolerates case variations that deviate from RFC 6750 specifications...