CVE-2026-87785

A vulnerability in Apache Syncope allows for an authentication bypass by spoofing. If the configured JWKS settings for internal JWT authentication (specifically the protocol and key) are disclosed, an attacker can spoof another user's privileges after successfully authenticating and obtaining a v...

PT-2026-31663

Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to before 13.7.1, there is an Authentication Bypass for client credentials tokens. the league/oauth2-server library sets the JWT sub claim to the client identifier since there's no user. The token guard then passes this value...