CVE-2021-44910_SpringBlade

CVE-2021-44910-SpringBlade Vulnerability Detection Tool SpringBlade JWT authentication vulnerability. Usage python3 Tested with HS256, HS384, and HS512 algorithms respectively...

sign-saboteur

SignSaboteur SignSaboteur is a Burp Suite extension for editing, signing, verifying, and attacking signed tokens. It supports different types of tokens: Django TimestampSigner, ItsDangerous Signer, Express cookie-session middleware, OAuth2 Proxy, Tornado’s signed cookies, Ruby Rails Signed cookie...

CVE-2019-19609-EXPLOIT

CVE-2019-19609-EXPLOIT Exploit for CVE-2019-19609 in Strapi Remote code execution in strapi-3.0.0-beta.17.7 or earlier. I was faced with a scenario with this vulnerability, but without a public exploit. I decided to create my own and share it here. Instalation git clone...

CVE-2019-20933

CVE-2019-20933 InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret aka shared secret. see https://nvd.nist.gov/vuln/detail/CVE-2019-20933 For more details PoC This PoC exploit...

Alibab-Nacos-Unauthorized-Login

Vuln Impact An issue has been discovered in Nacos affecting Nacos = 2.1.0.Nacos users use the default JWT key to cause an unauthorized access vulnerability. Through this vulnerability, attackers can bypass user name and password authentication and directly log in to the Nacos user Vuln Product...

PortSwigger-Web-Security-Academy

PortSwigger-Web-Security-Academy The interesting cases and m0r3 With nu11secur1ty 😎 Report as of June 2022 JWT - Module:...

demo-cve-2022-21449

Demo Project: CVE-2022-21449 Vulnerability This project demonstrates the CVE-2022-21449 vulnerability, which affects Java's ECDSA signature verification. The vulnerability allows a malicious actor to bypass signature verification by using a signature with zero values r=0 and s=0. The project uses...

CVE-2019-19609

CVE-2019-19609 Strapi Remote Code Execution Usage python3 exploit.py rhost jwt url lhost Exploit POC https://bittherapy.net/post/strapi-framework-remote-code-execution/...

CVE-2026-55459

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 - WSO2 I am @abraxasnull. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py. JWT alg mix-up. JWTUtil.verifyTokenSignature throws on non-RSA alg. Pre-patch...

krakenhashes

KrakenHashes KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface. Think of KrakenHash...

auth

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

pac4j-check

pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...

jwt-reauth

JWT Re-auth Burp plugin to cache authentication tokens from an "auth" URL, and then add them as headers on all requests going to a certain scope. Features The plugin allows settings to be sent to it via context menus from various menus. This includes using an entire captured request to acquire ne...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : Proof of Concept Proof of concept for the CVE-2022-39227. According to this CVE, there is a flaw in the JSON Web Token verification. It is possible with a valid token to re-use its signature with modified claims. Required: 1. A valid JSON Web Token. 2. The backend...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459

The Goobi viewer web application (versions 25.01 to before 26.05 ) contains an authentication vulnerability in AuthenticationEndpoint.verifyOpenIdToken. The application fails to enforce the aud claim during cryptographic validation when building the JWT verifier. Instead, it performs a manual str...

EUVD-2026-109063

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

auth

PlaceOS Authentication ENV VARS If a sentry Data Source Name is configured SENTRYDSN=https://@.ingest.sentry.io/ A shared secret for encrypting cookies SECRETKEYBASE=84b04ea4259542f365 JWT Private key JWTSECRET=Base64 Encoded RSA PRIVATE KEY Database name and host RETHINKDBDB=placedevelopment...