POC-CVE-2018-0114

CVE-2018-0114 POC Cisco node-jose 开源库 0.11.0 之前版本中存在一个漏洞，可能允许未经认证的远程攻击者使用嵌入在令牌中的密钥重新签名令牌。该漏洞是由于 node-jose 遵循了 JSON Web 令牌（JWT）的 JSON Web 签名（JWS）标准。该标准规定，表示公钥的 JSON Web 密钥（JWK）可以嵌入到 JWS 的头部中。然后该公钥被信任用于验证。攻击者可以通过移除原始签名、向头部添加新公钥，然后使用与该 JWS 头部中嵌入的公钥相关联的（攻击者拥有的）私钥对对象进行签名，从而伪造有效的 JWS 对象进行利用。...

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT 身份验证绕过演示 项目目标 本项目在受控的本地实验室环境中演示 CVE-2022-39227 漏洞。该漏洞影响 python-jwt 库（版本 3.3.4），允许攻击者在不了解密钥的情况下，通过利用 python-jwt 与其依赖 jwcrypto 之间的解析不一致性（JWS 序列化）来伪造 JWT 声明。 技术栈 Python 3.9 Flask （Web 框架） python-jwt 3.3.3 （存在漏洞的版本） python-jwt 3.3.4 （已修复/修补的版本） Docker 和 Docker Compose 项目架构 该项目使用...

jwtear

Jwtear セキュリティテスト目的でJSON Web Token（JWT）トークンを解析、作成、操作するためのモジュラー式コマンドラインツール。 機能 完全なモジュール性。 すべてのコマンドはプラグインです。 新しいプラグインの追加が簡単。 JWSおよびJWEトークンをサポート。 プラグインのための簡単なインターフェース。（テンプレート例に従う） 柔軟 プロダクションクラスのライブラリに基づくトークン生成（例：json-jwt、jwe）。 利用可能なプラグイン Parse: JWTトークンを解析します。 jws: JWSトークンを操作および生成します。 jwe:...

CVE-2025-65945-poc

CVE-2025-65945: node-jws 署名バイパス これは、node-jws ライブラリにおける署名検証バイパスの概念実証です。このバグにより、サーバーがユーザー制御のデータから HMAC 秘密鍵を導出する場合、攻撃者は有効な JWT を偽造できます。 バグの内容 jws.createVerify 関数は、HMAC アルゴリズムを使用する際に秘密鍵が実際に提供されたことを検証しません。アプリが JWT 内の何か（kid ヘッダーなど）に基づいて秘密鍵を検索し、その検索が失敗した場合、空の秘密鍵に対して検証してしまう可能性があります。 攻撃者はこれを次のように悪用できます： 1...

CVE-2018-0114-Exploit

CVE-2018-0114-エクスプロイト 0.11.0 より前の Cisco のオープンソースライブラリ node-jose には、認証されていないリモートの攻撃者が、トークンに埋め込まれた鍵を使用してトークンに再署名できる可能性がある脆弱性があります。この脆弱性は、node-jose が JSON Web Token JWT に対して JSON Web Signature JWS 標準に従っていることが原因です。この標準では、公開鍵を表す JSON Web Key JWK を JWS...

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

SummaryPyJWT 2.13.0 accepts compact JWS signature segments containing characters thatare not in the Base64URL alphabet. Appending !!!! to a valid signature doesnot change the decoded signature bytes or authenticated claims, but it changesthe serialized token and its SHA-256 hash. An application...

Rocky Linux 10.0 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2025_7479)

The Rocky Linux 10.0 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257479 advisory. go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-27144 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in...

GHSA-HXM8-2XGR-2P9M PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alphabet. Appending !!!! to a valid signature does not change the decoded signature bytes or authenticated claims, but it changes the serialized token and its SHA-256 hash. An applicati...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JsonWebSignature.deserializejson method in the JWS JSON serialization handling. An attacker can have unsigned or...

CVE-2026-96760

A flaw was found in authlib. This flaw allows a remote attacker to bypass digital signature verification and submit forged data. When processing a JSON Web Signature JWS, a format used to verify data integrity, the deserializejson function marks payloads as successfully verified without validatin...

CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760

The Authlib library (v1.7.2 and below) contains a signature verification bypass vulnerability within the JsonWebSignature.deserialize_json() method. When processing a JSON Serialization JWS object, the method returns the payload as successfully verified without validating a cryptographic signatur...

EUVD-2026-88465

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

POC-CVE-2018-0114

POC-CVE-2018-0114 Este repositorio contiene el PoC de un exploit para node-jose A partir de la última fusión python lib: base64,urllib,rsa,sys Ejecutando las pruebas Para ejecutar el script, simplemente ejecuta el siguiente comando: python jwk-node-jose.py "payload" key-size tamaño-de-clave sin A...

PT-2026-102339

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.7.3 Description An issue exists in the JWS general JSON serialization handler where the JsonWebSignature.deserialize json function accepts a JWS object with an empty signatures array and treats the payload as...

SUSE-SU-2026:23702-1 Security update for python-jwcrypto

This update for python-jwcrypto fixes the following issues: - CVE-2026-80179: denial of service via malformed JWE tokens bsc1277639. - CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification bsc1278707...

SUSE-SU-2026:23722-1 Security update for python-jwcrypto

This update for python-jwcrypto fixes the following issues: - CVE-2026-80179: denial of service via malformed JWE tokens bsc1277639. - CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet verification bsc1278707...

SUSE CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...