POC-CVE-2018-0114

CVE-2018-0114 POC Una vulnerabilidad en la librería de código abierto node-jose de Cisco, anterior a la versión 0.11.0, podría permitir a un atacante remoto no autenticado volver a firmar tokens utilizando una clave incrustada dentro del propio token. La vulnerabilidad se debe a que node-jose sig...

CVE-2026-102275

A flaw was found in PyJWT. When importing an Octet Key Pair OKP private JSON Web Key JWK, the library does not verify that the public key component matches the private key component. In applications that accept private key parameters from proof headers, a remote attacker can exploit this...

CVE-2026-102273

A flaw was found in PyJWT. This vulnerability allows an unauthenticated remote attacker to bypass authentication by forging arbitrary JSON Web Tokens JWTs. When an application allows both symmetric and asymmetric algorithms, PyJWT fails to properly validate public JSON Web Key JWK container...

CVE-2026-102272

A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...

CVE-2026-102266

A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...

CVE-2026-102274 PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.fromjwk in jwt/apijwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable...

CVE-2026-102273

The PyJWT Python library (versions 2.13.0 through 2.14.0 ) contains a vulnerability in HMACAlgorithm.prepare_key . The flaw occurs because the HMAC key guard fails to recognize container representations, allowing public JWK containers to be accepted as HMAC secrets when an application supports bo...

EUVD-2026-88541

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAlgorithm.preparekey is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations. This occurs when an application allows HMAC and asymmetric...

CVE-2018-0114

CVE-2018-0114 Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT. This vulnerability in Cisco's node-jose allows an attacker to forge malicious tokens. JWT allows users to embed public keys using the jwk value inside the header of the token. However,...

jwt-spoof-tool

jwt-spoof-tool Tool Description : I made this tool for learning purpose and automating jwt token hijacking without depending on using burpsuite the code is well documented and easy to follow Based on CVE-2018-0114 The Vulnerabilty happend because in backend the server check jwk object embeded...

CVE-2018-0114-PoC

CVE-2018-0114 PoC Escribí esto para PentesterLab Si eres de PentesterLab, no hagas trampa, es mucho mejor aprender. Espero que le sea útil a alguien, si no, a mí en el futuro : Ejemplo $ python3 script.py Making keys... 'alg': 'RS256', 'jwk': 'kty': 'RSA', 'kid': '[email protected]', 'use':...

Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2026-2051)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2051 advisory. PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector...

Medium: python-jwt

Issue Overview: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is...

Linux Distros Unpatched Vulnerability : CVE-2026-54431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4...

AZL-91682 CVE-2026-54431 affecting package liboauth 1.0.3-15

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...

CVE-2026-54431

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...

CVE-2026-54431

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...

CVE-2026-54431 Improper Data Validation in liboauth2

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...

CVE-2026-54431 Improper Data Validation in liboauth2

In liboauth2 the Demonstrating Proof-of-Possession DPoP verifier accepts a proof whose JSON Web Key jwk header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2tokenverify function returns success for a malformed DPoP proof that...

Security update for python-PyJWT

This update for python-PyJWT fixes the following issues CVE-2026-48522: PyJWKClient passes URI arguments directly to urllib.request.urlopen and allows for SSRF and token forgery bsc1266798. CVE-2026-48523: verifier-side algorithm allow-list bypass when jwt.decode or jwt.decodecomplete are called...