cve-2026-29000

CVE-2026-29000 Exploit JWT Authentication Bypass in pac4j-jwt via JWE-wrapped PlainJWT Vulnerability Description CVE-2026-29000 is a critical authentication bypass vulnerability affecting pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability allows remote attackers to forge...

krakenhashes

KrakenHashes KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface. Think of KrakenHash...

CVE-2026-75491

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an authentication bypass in the Mosquitto plugin auth_plugin_jwt.so . The root cause is the acceptance of unsigned JSON Web Tokens (JWTs) using the alg none algorithm. Attackers possessing any Cudy-trusted client certificate can authentic...

NextJS-CVE-2025-29927

Here's a clean and informative README.md for your GitHub repo that explains it's a vulnerable Next.js application for CVE-2025-29927 and includes a link to your setup YouTube video: 🔓 NextJS-CVE-2025-29927 - Vulnerable Demo Application This is a vulnerable Next.js application that demonstrates...

CVE-2021-44910_SpringBlade

CVE-2021-44910-SpringBlade Vulnerability Detection Tool SpringBlade JWT authentication vulnerability. Usage python3 Tested with HS256, HS384, and HS512 algorithms respectively...

CVE-2026-5430

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-5430 Write-up: https://abraxaslabs.tech/research/CVE-2026-5430 CVE-2026-5430 WSO2 API Manager 4.5.0 - WSO2 I am @abraxasnull. Loopback lab. The client is CVE-2026-5430-Abraxas-Labs.py. JWT alg mix-up...

CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage $ python CVE-2026-55040.py --help...

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT Authentication Bypass Demo Project Goal This project demonstrates the CVE-2022-39227 vulnerability in a controlled local lab environment. This vulnerability affects the python-jwt library versions 3.3.4 and allows an attacker to forge JWT claims without knowing the secret key b...

safenet-soho-security-framework

SafeNet SOHO Security Framework SafeNet is a production-grade Zero-Trust Network Access ZTNA framework specifically engineered for Small Office/Home Office SOHO environments. By orchestrating a secure, identity-aware VPN overlay utilizing the WireGuard protocol, SafeNet provides granular control...

cve-2026-93355-lab

CVE-2026-93355 — LiteLLM unverified-email JWT account takeover lab A self-contained, disposable lab that reproduces CVE-2026-93355: LiteLLM 's JWT authentication resolves a caller's identity by falling back to an email match — and never checks theemailverified claim. An attacker who can make thei...

WordPress GS JWT Authentication for WP REST API plugin <= 1.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin GS JWT Authentication for WP REST API versions = 1.0.0...

CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

EUVD-2026-117910

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

CVE-2026-113615 GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session...

CVE-2026-113615

The GS JWT Authentication for WP REST API WordPress plugin (versions prepare() and ensure OTP checks are strictly validated. Proof of concept and exploitation details are available at https://github.com/thiscitze/cve-2026-113615-poc .

CVE-2026-61729

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verifygraylogheader in backend/app/activeresponse/routes/graylog.py and verifyvelociraptorheader in backend/app/incidents/routes/incidentalert.py authenticate webhooks against...

PT-2026-133607

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verify graylog header in backend/app/active response/routes/graylog.py and verify velociraptor header in backend/app/incidents/routes/incident alert.py authenticate webhooks...

CVE-2026-61729: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verifygraylogheader in backend/app/activeresponse/routes/graylog.py and verifyvelociraptorheader in backend/app/incidents/routes/incidentalert.py authenticate webhooks against...

EUVD-2026-111132

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...

Nextcloud Whiteboard server request forgery vulnerability

Versions prior to Nextcloud Whiteboard 1.0.0 contain a server-side request forgery vulnerability. This vulnerability arises from the ability to access the internal Chrome DevTools Protocol API, which can be used to expose another user’s JWT authentication token. Low-privilege attackers can exploi...