CVE-2026-118394

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

EUVD-2026-114802

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : Proof of Concept Proof of concept for the CVE-2022-39227. According to this CVE, there is a flaw in the JSON Web Token verification. It is possible with a valid token to re-use its signature with modified claims. Required: 1. A valid JSON Web Token. 2. The backend...

cmcp

cMCP: Confidential MCP Runtime Community updates and contributor highlights: AgenTrust on LinkedIn. Enforce MCP tool policy inside a TEE, where the agent it governs cannot reach it Quick Start · Architecture · Configuration · CLI · Changelog Developer Preview - launched at the Confidential...

CVE-2026-118394: Gitea: The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public…

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

PT-2026-134879

The OAuth2 userinfo endpoint /login/oauth/userinfo decided whether to limit the groups claim to public organizations by re-parsing the Authorization header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was se...

CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-Issuer Authentication Bypass Description AadB2cResourceServerAutoConfiguration in spring-cloud-azure-autoconfigure builds a JwtDecoder that trusts six AAD-line issuers login.microsoftonline.com, sts.windows.net, sts.chinacloudapi.cn, v1...

CVE-2023-3128

CVE-2023-3128 To check if a domain is vulnerable to CVE-2023-3128, which involves an authentication bypass in Grafana due to Azure AD email claim validation, you can use the following Python script: !/usr/bin/env python3 import requests import argparse def checkcve20233128targeturl, verbose=False...

CVE-2018-0114-Go

CVE-2018-0114 Proof of Concept Reference: CVE-2018-0114 Note: For educational purposes only. To generate a JWT with the claim "admin", run the following command in the project directory: go run . --claim=admin /\ \ /\ /\ \ /\ \ /'\ /'\ /' \ /' \ /'\ /' \ /' \ /\ \ \ \ \ /\ \ \ \ \ \ \ \ \L\...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main JWT iss/aud not validated Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-main embedded HTTP server builds its JWT authenticator from a keystore alone when neither jwtIssuer nor jwtAudience is configured, so inbound...

hdwebmobile-booking-appointments

HDWebmobile Booking & Appointments Sell bookable services and appointments through WooCommerce, with a per-slot capacity that can never be oversold. WordPress.org: https://wordpress.org/plugins/hdwebmobile-booking-appointments/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or lat...

CVE-2026-85473

A flaw was found in auth0/java-jwt. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a JSON Web Token JWT containing an out-of-range timestamp claim. Because the issue occurs during token parsing before cryptographic signature verification, processing these malforme...

CVE-2025-30144

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

CVE-2026-119597: AIDotNet OpenDeepWiki: OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to…

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin...

SUSE CVE-2026-110952

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, @sd-jwt/decode, also used by @sd-jwt/core, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed sd array and returns a reduced claim set,...

CVE-2026-42707

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4...

CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification...