186 matches found
CVE-2026-66908
A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...
CVE-2026-75509
A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption JOSE standards. A remote attacker could exploit a vulnerability in the JWTClaimsRegistry by crafting a JSON Web Token JWT with an array-valued issuer iss claim. This flaw allows the attacker to bypass the intende...
Linux Distros Unpatched Vulnerability : CVE-2026-75509
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3,...
CVE-2026-75509
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
CVE-2026-75509
joserfc is a Python library implementing JOSE standards. Prior to version 1.7.3 , the JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, meaning an array-valued iss claim that merely contains the expected issuer will pass an intended equality check. This enables issu...
GHSA-FPM2-M4QQ-WGHR Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...
CVE-2026-12616
The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates that string into three log statements before any validation gate. Because the configured log format "%asctimes - %names - %levelnames - %messages" renders...
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' Audience claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users...
EUVD-2007-3815
Malware in sbrugna...
EUVD-2006-3834
Malware in sbrugna...
EUVD-2002-1110
Malware in sbrugna...
EUVD-2003-1597
Malware in sbrugna...
EUVD-2005-2712
Malware in sbrugna...
EUVD-2002-0234
Malware in sbrugna...
EUVD-2006-7111
Malware in sbrugna...
EUVD-2003-0693
Malware in sbrugna...
EUVD-2003-1596
Malware in sbrugna...
EUVD-2007-3814
Malware in sbrugna...