CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage $ python CVE-2026-55040.py --help...

cve-2022-39227-jwt-auth-bypass-demo

CVE-2022-39227 JWT Authentication Bypass Demo Project Goal This project demonstrates the CVE-2022-39227 vulnerability in a controlled local lab environment. This vulnerability affects the python-jwt library versions 3.3.4 and allows an attacker to forge JWT claims without knowing the secret key b...

cve-2026-29000

CVE-2026-29000 Exploit JWT Authentication Bypass in pac4j-jwt via JWE-wrapped PlainJWT Vulnerability Description CVE-2026-29000 is a critical authentication bypass vulnerability affecting pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability allows remote attackers to forge...

CVE-2026-61729

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verifygraylogheader in backend/app/activeresponse/routes/graylog.py and verifyvelociraptorheader in backend/app/incidents/routes/incidentalert.py authenticate webhooks against...

PT-2026-133607

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verify graylog header in backend/app/active response/routes/graylog.py and verify velociraptor header in backend/app/incidents/routes/incident alert.py authenticate webhooks...

CVE-2026-61729: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verifygraylogheader in backend/app/activeresponse/routes/graylog.py and verifyvelociraptorheader in backend/app/incidents/routes/incidentalert.py authenticate webhooks against...

Linux Distros Unpatched Vulnerability : CVE-2026-25554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSIPS versions 3.1 before 3.6.4 containing the authjwt module prior to commit 3822d33 contain a SQL injection vulnerability in the jwtdbauthorize function in...

CVE-2026-50561

Summary: CVE-2026-50561 affects Yuxi prior to 0.6.2 where the Authorization header token is only authenticated for validity, not validated across deployments. This enables an administrator token from one deployment or local test environment to gain access to the backend management interfaces of a...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2023-27584

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

CVE-2023-33236

MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs...