CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download

Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILEDOWNLOADSIGNSECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to...

RLSA-2026:80605 Critical: cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 For more details about the security issues, including the impact, a CVSS score,...

USN-8916-1: PyJWT vulnerabilities

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. This issue only affected Ubuntu 26.04 LTS. CVE-2026-102266 Rohan Das discovered that PyJWT incorrectly handled...

USN-8916-1 pyjwt vulnerabilities

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. This issue only affected Ubuntu 26.04 LTS. CVE-2026-102266 Rohan Das discovered that PyJWT incorrectly handled...

Updated cjose packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap buffer overflow in AES Key Wrap decryption A128KW/A192KW/A256KW. CVE-2026-53938 All-zero Content Encryption Key used for AES-CBC-HMAC JWE encryption. CVE-2026-53939...

cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...

Critical: Red Hat Security Advisory: cjose security update

An update for cjose is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

ALSA-2026:80605 Critical: cjose security update

CJose is C library implementing the Javascript Object Signing and Encryption JOSE. Security Fixes: cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 For more details about the security issues, including the impact, a CVSS score,...

AlmaLinux 10 : cjose (ALSA-2026:80605)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:80605 advisory. cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption CVE-2026-53939 Tenable has extracted the preceding description block...

TencentOS Server 4: python-jwt (TSSA-2026:1087)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1087 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

jwt-cracker

jwt-cracker Simple cracker de fuerza bruta para tokens JWT HS256, HS384 y HS512. Efectivo solo para vulnerar tokens JWT con secretos débiles. Recomendación : utiliza secretos largos y fuertes o tokens RS256. Instalación Con npm: npm install --global jwt-cracker Uso Desde la línea de comandos:...

fwknop

fwknop - Autorización de Paquete Único Introducción fwknop implementa un esquema de autorización conocido como Autorización de Paquete Único SPA, por sus siglas en inglés para un fuerte ocultamiento de servicios. SPA requiere solo un único paquete que está cifrado, no reproducible y autenticado...

badsecrets

badsecrets Una biblioteca pura de Python para identificar el uso de secretos criptográficos conocidos o muy débiles en una variedad de plataformas. El proyecto está diseñado tanto para ser un repositorio de varios "secretos conocidos" por ejemplo, claves de máquina de ASP.NET encontradas en...

cjose security update

0.6.2.2-7.2 - Fix CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-276901...

SUSE-SU-2026:24134-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

CVE-2026-107722

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...

CVE-2026-107724

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery vulnerability discovered by ? in WordPress Npm fast-jwt versions 6.2.4...

CVE-2026-107724

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107722

fast-jwt provides fast JSON Web Token JWT implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatch...