CVE-2025-29927

CVE-2025-29927 - Next.js Middleware 15.2.2 - Authorization Bypass ⚠️ Critical Authentication Bypass in NextJS Middleware 🛠️ PoC implementation by @zs1n 💡 Overview NextJS is a popular React-based web framework, has an authentication vulnerability that affects versions prior to 12.3.5, 13.5.9,...

CVE-2025-2825-CrushFTP-AuthBypass

🚨 CVE-2025-2825 – CrushFTP Authentication Bypass 🔎 Overview CVE-2025-2825 is a critical authentication bypass vulnerability affecting CrushFTP , a widely used secure file transfer server. The flaw allows remote attackers to bypass login authentication and gain administrative access by spoofing...

CVE-2018-13257

Blackboard Learn CAS Ticket Host Header Spoofing An authentication module within Blackboard Learn is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation. A CAS service ticket is intended for only a specific service , but Blackboard Learn do...

N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 id: CVE-2026-86206 info: name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing author:...

CVE-2026-35616-check

CVE-2026-35616 Vulnerability Assessment Tool Safely detect whether a FortiClient EMS server is vulnerable to CVE-2026-35616 without causing any disruption. See the full write-up on the Bishop Fox blog. Description CVE-2026-35616 is a pre-authentication API bypass in FortiClient EMS 7.4.5 and 7.4....

CVE-2026-88004

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

EUVD-2026-75538

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-88004 Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

PT-2026-89452

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-35616

CVE-2026-35616 Author: wa6n3r | GitHub | Web Description Exploitation of the certificate chain verification bypass vulnerability in the Fortinet API. The script automatically discovers valid Common Names CN from various sources, generates a fake client certificate, and performs requests to...

CVE-2025-29927

CVE-2025-29927 — Next.js middleware authorization bypass Summary: vulnerability in Next.js middleware allowing authorization bypass by spoofing the x-middleware-subrequest header. Table of Contents CVE-2025-29927 — Next.js middleware authorization bypass Table of Contents Gathering vulnerable hos...

CVE-2019-17240

CVE-2019-17240 Exploit Versions prior to and including 3.9.2 of the Bludit CMS are vulnerable to a bypass of the anti-brute force mechanism that is in place to block users that have attempted to incorrectly login 10 times or more. The vulnerability was discovered by Rastating. Submitting a login...

CVE-2026-78560

CVE-2026-78560 affects the Okta Access Gateway , specifically its optional pass-through authentication source , which accepts user identity from a client-supplied HTTP header without cryptographic validation. When this source is enabled without an upstream reverse proxy or firewall that sanitizes...

CVE-2026-82533 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

CVE-2026-82533

DeepSeek Harness prior to 0.1.2-alpha.1 contains an authentication bypass in its local HTTP control-plane API. The root cause is that the server validates only the client-supplied Host header rather than the actual TCP connection origin, allowing a network attacker to spoof authentication. This p...

CVE-2026-82533 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP Allowlist Bypass CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Refs: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED resolves the client IP from the attacker-controlled X-Forwarded-For then Client-IP headers before falling back to REMOTEADDR. There is no trusted-proxy concept,...

PT-2026-87187

🚨 AI AGENTS IN DEEPSEEK HARNESS CAN DISABLE THEIR OWN SANDBOX 🚨 CVE-2026-82533, CVSS 9.4, DeepSeek Harness dsh. 215,000+ GitHub stars, fastest growing repo. One. curl. command. = sandbox escape. 🤯 The harness ships an OS sandbox so a coding agent working on untrusted material can't reach your...

0xMiddleware

CVE-2025-29927：Next.js 中间件利用工具 该工具演示并自动化利用 CVE-2025-29927 ，这是一个存在于 Next.js 中的漏洞，攻击者可利用内部请求头 x-middleware-subrequest 绕过中间件检查 （如身份验证）。 🔧 漏洞利用原理 Next.js 内部使用 x-middleware-subrequest 请求头来防止递归请求中的无限循环。然而，在某些版本中，该请求头并未针对外部篡改进行保护 ，恶意攻击者可以对其进行伪造。 通过手动设置该请求头，负责执行身份验证、重定向、日志记录或过滤 的中间件逻辑将被完全跳过 。 该工具的功能：...