cmcp

cMCP: Runtime MCP Confidencial Aplica la política de herramientas MCP dentro de un TEE, donde el agente que gobierna no puede alcanzarlo Inicio rápido · Arquitectura · Configuración · CLI · Registro de cambios Vista previa para desarrolladores - lanzado en la Cumbre de Computación Confidencial, 2...

distributed-system-testing

Distributed Systems Testing Skills Two skills for AI coding agents that design and run claim-driven tests for distributed and stateful systems. Together they produce a structured Markdown test plan and a findings report with 10-state verdicts and an explicit SUT / harness / checker / environment...

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

PT-2026-90401

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients still reclaiming clients still reclaiming computes a deadline from nn-boot time CLOCK REALTIME, 1.7 billion but compares it against ktime get boottime seconds CLOCK BOOTTIME, seconds sin...

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Summary On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account th...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : 概念验证 此 CVE-2022-39227 的概念验证代码。根据该CVE，JSON Web Token验证存在缺陷。可以通过有效的令牌，利用其签名与修改后的声明一起使用。 所需条件： 1. 一个有效的JSON Web Token。 2. 后端使用的是版本低于 3.3.4 的 Python 库 "python-jwt"。 为了方便使用，我在一次CTF中编写了一个简单的PoC： root@kitploit: usage: CVE-2022-39227-PoC -h -j TOKEN -i CLAIM Proof of Conce...

CVE-2025-30144

摘要 fast-jwt 库未能根据 RFC https://datatracker.ietf.org/doc/html/rfc7519page-9 正确验证 iss 声明。 详情 fast-jwt 库中的 iss（颁发者）声明验证允许将字符串数组作为有效的 iss 值。这一设计缺陷导致潜在攻击，恶意行为者可以构造一个 JWT，其 iss 声明格式为 'https://attacker-domain/', 'https://valid-iss'。由于宽松的验证，该 JWT 将被视为有效。 此外，如果应用程序依赖像 get-jwks 这样的外部库，且这些库不独立验证 iss...

hdwebmobile-booking-appointments

HDWebmobile Reservas y Citas Vende servicios y citas reservables a través de WooCommerce, con una capacidad por franja horaria que nunca puede sobrevenderse. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requiere: WordPress 6.9+, WooCommerce, PHP 7.4+ Licencia:...

CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C 资源服务器跨身份颁发者认证绕过 描述 spring-cloud-azure-autoconfigure 中的 AadB2cResourceServerAutoConfiguration 构建了一个 JwtDecoder，该解码器信任从 AadB2cTrustedIssuerRepository.java:30 中的 AadTrustedIssuerRepository 继承的六个 AAD...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main: no se validan iss/aud de JWT Reproductor de prueba de concepto ejecutable para la vulnerabilidad de Apache Camel en la que el servidor HTTP embebido de camel-main crea su autenticador JWT únicamente a partir de un almacén de claves cuando no se configura...

CVE-2023-3128

CVE-2023-3128 要检查某个域名是否存在 CVE-2023-3128 漏洞（该漏洞涉及 Grafana 中因 Azure AD 电子邮件声明验证不严而导致的身份验证绕过），可以使用以下 Python 脚本： !/usr/bin/env python3 import requests import argparse def checkcve20233128targeturl, verbose=False: """Check for CVE-2023-3128 vulnerability""" session = requests.Session root@kitploit: St...

CVE-2018-0114-Go

CVE-2018-0114 概念证明 参考：CVE-2018-0114 注意： 仅用于教育目的。 要生成包含 "admin" 声明的JWT，请在项目目录中运行以下命令： root@kitploit: go run . --claim=admin root@kitploit: /\ \ /\ /\ \ /\ \ /'\ /'\ /' \ /' \ /'\ /' \ /' \ /\ \ \ \ \ /\ \ \ \ \ \ \ \ \L\ /\ /\ \ /\ /\ \ /, \ /\ \L\ \ /\ /\ \ /, \ /, \ \ \ \ \ \ \ // \ ...

CVE-2026-55658 Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim()

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the...

CVE-2026-55658

Gardens v2 , a modular governance framework, is affected in commit 3e595f3 and prior. When a streaming proposal is funded, pool funds are moved into the proposal's StreamingEscrow to back a Superfluid constant flow agreement. However, cancelProposal zeroes the escrow's GDA member units without re...

CVE-2026-73208

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

CVE-2026-61641

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...

cmcp v0.4.0

cMCP: Confidential MCP Runtime Enforce MCP tool policy inside a TEE, where the agent it governs cannot reach it Quick Start · Architecture · Configuration · CLI · Changelog Developer Preview - launched at the Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0. See...

BIT-KEYCLOAK-2026-18572 Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours. A flaw was discovered where a user can include a fake time value in their authorization request that overrides the...

Linux Distros Unpatched Vulnerability : CVE-2026-73208

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the...

AZL-98295 CVE-2026-73208 affecting package dovecot 2.3.20-1

An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...