96 matches found
RS256-2-HS256
RS256-2-HS256 JWT Attack to change the algorithm RS256 to HS256 Usage usage: RS2562HS256JWT.py -h payload pubkey positional arguments: payload JSON payload from JWT to attack pubkey Public key file to use for signing optional arguments: -h, --help show this help message and exit Example...
poc-cve-2016-10555
Change the algorithm RS256asymmetric to HS256symmetric - POC CVE-2016-10555 The algorithm HS256 uses the secret key to sign and verify each message. The algorithm RS256 uses the private key to sign the message and uses the public key for authentication. If you change the algorithm from RS256 to...
CVE-2021-44910_SpringBlade
CVE-2021-44910-SpringBlade Vulnerability Detection Tool SpringBlade JWT authentication vulnerability. Usage python3 Tested with HS256, HS384, and HS512 algorithms respectively...
jwt_tool
The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...
jwt-key-confusion-poc
Preuve de concept de confusion de clés JWT CVE-2015-9235 Écrit pour les défis Hack the Box - Under Construction et Secret Les deux scripts inclus effectuent une attaque par confusion de clés de jeton Web Java CVE-2015-9235. Pour effectuer l'attaque, l'attaquant doit connaître la clé publique que ...
jwt-key-id-injector
Инжектор идентификатора ключа JWT Простой скрипт на Python для проверки гипотетической уязвимости JWT. Допустим, есть приложение, которое использует JWT-токены, подписанные алгоритмом HS256. Пример токена выглядит следующим образом:...
jwt-key-id-injector
JWT Key ID Injector Simple python script to check against hypothetical JWT vulnerability. Let's say there is an application that uses JWT tokens signed HS256 algorithm. An example token looks like the follow:...
CVE-2026-75431_PowerJob_jwt_key_predictable
Предсказуемый ключ подписи JWT в PowerJob ключ, производный от URL JDBC по умолчанию → подделка токена 1. Краткое описание Ключ подписи JWT HS256 сервера PowerJob формируется путем BASE64-декодирования жестко заданной константы, объединенной с MD5-хешем URL JDBC по умолчанию DefaultSecretProvider...
CVE-2026-82329-poc
CVE-2026-82329 Инструмент оценки безопасности Artifactory PoC и инструмент валидации для выявления self-hosted установок JFrog Artifactory, затронутых CVE-2026-82329. Инструмент проверяет следующую цепочку аутентификации: 1. Создание поддельного JWT HS256 с использованием пустого ключа подписи по...
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time:- The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop.- The verification key is...
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
SummaryA service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated.PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts th...
kit-jwt
kit-jwt JSON Web Token JWT encoding and decoding for Kit TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit LICENSE| MIT license file README.md| This file...
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...
GHSA-9J54-FG26-WV3R PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Summary A service that verifies HS256 tokens using an empty oct JWK through PyJWK, including a PyJWK obtained from PyJWKSet, can therefore accept attacker-generated tokens as authenticated. PyJWT 2.13.0 rejects an empty HMAC key when it is supplied through the raw str/bytes key path, but accepts...
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
Prerequisites both conditions must hold; both are deployment properties, not attacker-controlled at request time: - The jwt.decode allow-list mixes an HMAC algorithm with an asymmetric one, e.g. algorithms="ES256", "HS256" the RFC 8725 footgun the guard exists to backstop. - The verification key ...
PyJWT accepts public JWK containers as HMAC secrets
Summary PyJWT 2.13.0 contains an incomplete defense against algorithm confusion when an application mixes symmetric and asymmetric algorithms in one verification path. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when it is wrapped in a JWKS object, nested in an array, or...
GHSA-W2CX-738M-MC7W PyJWT accepts public JWK containers as HMAC secrets
Summary PyJWT 2.13.0 contains an incomplete defense against algorithm confusion when an application mixes symmetric and asymmetric algorithms in one verification path. A public RSA, EC, or OKP JWK can be accepted as an HMAC secret when it is wrapped in a JWKS object, nested in an array, or...
CVE-2026-89026
CVE-2026-89026 --- Эксплойт и сканер Issabel PBXAPI О проекте CVE-2026-89026 — это уязвимость в системе безопасности, на которую нацелен данный проект. Данный репозиторий содержит PoC-эксплойт и сканер для исследования и проверки поведения аутентификации в затронутом Issabel PBXAPI. Проект...
POC_CVE-2015-9235
CVE-2015-9235 Démonstration de l'attaque par confusion d'algorithme sur les bibliothèques Json Web Token JWT. Les JWT sont souvent utilisés dans les cookies pour certifier une session utilisateur, donc cette attaque est critique. Le module Node [email protected] a été utilisé pour démontrer ...
