CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

Herramienta de Explotación CVE-2026-1529 para Keycloak Keycloak: Registro no autorizado de organizaciones mediante validación incorrecta de tokens de invitación Aviso Legal Esta herramienta es solo para fines educativos y de pruebas de seguridad. Úsela únicamente en sistemas para los que tenga...

jwt_tool

JSON Web Token 工具包 v2 jwttool.py 是一个用于验证、伪造、扫描和篡改 JWT（JSON Web Token）的工具包。 其功能包括： 检查令牌的有效性 测试已知漏洞利用： CVE-2015-2951 alg=none 签名绕过漏洞 CVE-2016-10555 RS/HS256 公钥不匹配漏洞 CVE-2018-0114 密钥注入 漏洞 CVE-2019-20933/CVE-2020-28637 空白密码 漏洞 CVE-2020-28042 空签名 漏洞 CVE-2022-21449 Psychic Signature ECDSA 漏洞 扫描错误配置或已知弱...

MyJWT

MyJWT codebeat badge 简介 该命令行工具适用于渗透测试人员、CTF玩家或开发者。 你可以修改你的JWT、签名、注入等操作。 查看文档了解更多信息。 如果发现任何问题或有改进建议，请提交Issue。我会尽快回复。 祝使用愉快 : 文档 文档位于 http://myjwt.readthedocs.io 目录 Features Installation Usage Examples Download Contribute ChangeLog Features 将新的JWT复制到剪贴板 用户界面（感谢 questionary） 彩色输出 修改JWT（头部/载荷） None算法...

Zabbix-cve-2022-23131-SSO-bypass

Zabbix-cve-2022-23131-SSO-bypass Para omitir el portal de inicio de sesión SSO de Zabbix, asegúrate de tomar la cookie de tu navegador. Reemplázala con la que está en el script. Asegúrate también de cambiar el nombre de usuario con el que deseas iniciar sesión y ejecuta el exploit la mayoría de l...

CVE-2026-86274

A missing authorization vulnerability exists in the Authentication Flow component of projeto-siga (siga), affecting versions up to 11.0.2.10/11.0.2.13/11.1.1 . The flaw is in the ExAutenticacaoController.autenticar function within sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoContro...

CVE-2026-86274 projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization

A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such...

PT-2026-86631

A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such...

CVE-2025-47411

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...

CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over...

CVE-2023-48309

NextAuth.js provides authentication for Next.js. next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth...

CVE-2021-4314

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the...

Code injection

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the...

CVE-2021-4314

It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. This is happening only in the situation when zOSMF doesn’t have the APAR PH12143 applied. This issue affects: 1.16 versions to 1.19. What happens is that the...

Forgeable Public/Private Tokens in jws

Affected versions of the jws package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the...