53 matches found
CVE-2025-65945-poc
CVE-2025-65945: node-jws 签名绕过 这是 node-jws 库中签名验证绕过漏洞的概念验证。该漏洞允许攻击者在服务器从用户可控数据派生 HMAC 密钥时伪造有效的 JWT。 漏洞原理是什么？ jws.createVerify 函数在使用 HMAC 算法时，不会验证是否确实提供了密钥。如果你的应用程序根据 JWT 中的某些内容（如 kid 头）查找密钥，并且查找失败，那么你最终可能会使用空密钥进行验证。 攻击者可以利用这一点： 1. 发送一个包含不存在于数据库中的虚假密钥 ID 的 JWT 2. 使用空字符串作为密钥签署其恶意负载 3. 服务器的查找返回...
CVE-2026-85595
Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authenticatio...
CVE-2026-85595 Traefik before v2.11.55 Authentication Bypass via digestAuth
Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authenticatio...
CVE-2026-85595
Traefik versions before v2.11.55 contain an authentication bypass in the digestAuth middleware . The root cause is that unknown usernames receive an empty secret instead of being rejected, allowing an attacker to compute a valid digest response using that empty secret and arbitrary credentials. T...
CVE-2025-10294
漏洞利用：通过空的 ownidsharedsecret 绕过认证（JWT伪造） 1 使用空HMAC密钥伪造有效的JWT root@kitploit: SUB= SUB="$SUB" python3 - /tmp/jwt.txt import base64, hmac, hashlib, json, time, os b64u = lambda b: base64.urlsafeb64encodeb.rstripb'='.decode header = b64ujson.dumps"typ":"JWT","alg":"HS256", separators=",",":".encode...
CVE-2026-46701
Summary (markdown): Network-AI’s MCP SSE server defaults to an empty secret prior to v5.4.5, causing _isAuthorized to return true for all requests and enabling unauthenticated cross-origin tool calls. The server also unconditionally sets Access-Control-Allow-Origin: *, allowing browser contexts t...
CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret process.env'NETWORKAIMCPSECRET' ?? '' at bin/mcp-server.ts:89, which causes isAuthorized lib/mcp-transport-sse.ts:254 to return true unconditionally for every reques...
CVE-2026-11575
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...
CVE-2026-11575
The vulnerability affects the PhonePe Payment Solutions WordPress plugin prior to 3.1.0. The issue is that the secret used to validate the callback signature is empty on sites configured through the current setup flow, causing the expected signature to be an unkeyed hash of the request body. This...
EUVD-2026-45145
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...
CVE-2026-11575 PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...
CVE-2026-11575
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash...
GHSA-GQ4G-FPC9-VJFQ Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
Impact Webauthn\SimpleFakeCredentialGenerator is the library-provided default implementation of the FakeCredentialGenerator interface. It returns a stable list of decoy PublicKeyCredentialDescriptor objects for a given username so that an assertion request for an unknown user looks the same as a...
CVE-2026-54887 DTLS server cookie bypass during startup window due to empty initial cookie secret
Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl DTLS server allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtlsserverconnection:initialhello/3 initializes previouscookiesecret to the empty...
GO-2026-5753 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api...
EUVD-2026-37787
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests...
GHSA-R78R-RWRF-RJWP Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Advisory / Disclosure Network-AI — CVE-2026-46701 fix is incomplete: the "Empty Default Secret" unauth path survives Target: Jovancoding/Network-AI npm network-ai, latest v5.7.1 Status: the advisory "Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret" named three flaws. The...
GHSA-W5CV-PW74-4RXC opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication
githubreceiver Silently Ignores Configured requiredheaders Authentication Summary The githubreceiver webhook handler does not enforce the requiredheaders configuration. Headers are validated at startup config rejects empty keys/values but never checked on incoming requests. This follows the same...
PT-2026-50743
Name of the Vulnerable Software and Affected Versions opentelemetry-collector-contrib affected versions not specified Description The githubreceiver webhook handler fails to enforce the required headers configuration. While these headers are validated during startup, they are not checked on...