8 matches found
CVE-2025-30144
摘要 fast-jwt 库未能根据 RFC https://datatracker.ietf.org/doc/html/rfc7519page-9 正确验证 iss 声明。 详情 fast-jwt 库中的 iss（颁发者）声明验证允许将字符串数组作为有效的 iss 值。这一设计缺陷导致潜在攻击，恶意行为者可以构造一个 JWT，其 iss 声明格式为 'https://attacker-domain/', 'https://valid-iss'。由于宽松的验证，该 JWT 将被视为有效。 此外，如果应用程序依赖像 get-jwks 这样的外部库，且这些库不独立验证 iss...
CVE-2026-87785
Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...
CVE-2026-87785 Apache Syncope: JWT subject spoofing
Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed at least protocol and key, an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. Thi...
EUVD-2025-23514
Malicious code in bioql PyPI...
CVE-2025-44963
RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...
PT-2025-31827 · Ruckus · Ruckus Network Director
Name of the Vulnerable Software and Affected Versions: RUCKUS Network Director versions prior to 4.5 Description: RUCKUS Network Director RND is susceptible to an issue allowing an attacker to spoof an administrator JSON Web Token JWT if they possess knowledge of a hardcoded secret key...
