cmcp

cMCP: Runtime MCP Confidencial Aplica la política de herramientas MCP dentro de un TEE, donde el agente que gobierna no puede alcanzarlo Inicio rápido · Arquitectura · Configuración · CLI · Registro de cambios Vista previa para desarrolladores - lanzado en la Cumbre de Computación Confidencial, 2...

distributed-system-testing

Distributed Systems Testing Skills Two skills for AI coding agents that design and run claim-driven tests for distributed and stateful systems. Together they produce a structured Markdown test plan and a findings report with 10-state verdicts and an explicit SUT / harness / checker / environment...

CVE-2023-3128

CVE-2023-3128 Para verificar si un dominio es vulnerable a CVE-2023-3128, que implica un bypass de autenticación en Grafana debido a la validación de afirmación de correo electrónico de Azure AD, puedes usar el siguiente script de Python: !/usr/bin/env python3 import requests import argparse def...

CVE-2018-0114-Go

CVE-2018-0114 Prueba de concepto Referencia: CVE-2018-0114 Nota: Solo con fines educativos. Para generar un JWT con el claim "admin", ejecuta el siguiente comando en el directorio del proyecto: go run . --claim=admin /\ \ /\ /\ \ /\ \ /'\ /'\ /' \ /' \ /'\ /' \ /' \ /\ \ \ \ \ /\ \ \ \ \ \ \ ...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : Prueba de concepto Prueba de concepto para el CVE-2022-39227. Según este CVE, hay una falla en la verificación de JSON Web Token. Es posible, con un token válido, reutilizar su firma con claims modificados. Requisitos: 1. Un JSON Web Token válido. 2. El backend deb...

CVE-2026-103001

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

SummaryPyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a config...

CVE-2025-30144

Resumen La librería fast-jwt no valida correctamente la reclamación iss según la RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Detalles La validación de la reclamación iss emisor dentro de la librería fast-jwt permite un array de cadenas como valor válido de iss. Este defecto de diseño...

GHSA-GVP8-978C-RX2Q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

EUVD-2026-90388

PyJWT.decode reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse...

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

AZL-105642 CVE-2026-103001 affecting package python-jwt 2.13.0-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

CVE-2026-103001

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

CVE-2026-103001

The PyJWT library (versions 2.11.0 through 2.13.0 ) contains a vulnerability where the PyJWT._merge_options() method modifies a caller-supplied mutable options mapping when verify_signature is set to false . If an application reuses this same mapping for subsequent decode() or decode_complete() c...

CVE-2026-103001 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

CVE-2026-103001 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

CVE-2026-87004 Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims...

CVE-2026-103054

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability within the MSSP module . This flaw allows authenticated users to submit tenant UUIDs via the add_tenants_to_portfolio endpoint, enabling them to claim unclaimed tenants and access sensitive data, including security alerts,...

CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-Issuer Authentication Bypass Description AadB2cResourceServerAutoConfiguration in spring-cloud-azure-autoconfigure builds a JwtDecoder that trusts six AAD-line issuers login.microsoftonline.com, sts.windows.net, sts.chinacloudapi.cn, v1...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main: no se validan iss/aud de JWT Reproductor de prueba de concepto ejecutable para la vulnerabilidad de Apache Camel en la que el servidor HTTP embebido de camel-main crea su autenticador JWT únicamente a partir de un almacén de claves cuando no se configura...