jwt_tool

JSON Web Token 工具包 v2 jwttool.py 是一个用于验证、伪造、扫描和篡改 JWT（JSON Web Token）的工具包。 其功能包括： 检查令牌的有效性 测试已知漏洞利用： CVE-2015-2951 alg=none 签名绕过漏洞 CVE-2016-10555 RS/HS256 公钥不匹配漏洞 CVE-2018-0114 密钥注入 漏洞 CVE-2019-20933/CVE-2020-28637 空白密码 漏洞 CVE-2020-28042 空签名 漏洞 CVE-2022-21449 Psychic Signature ECDSA 漏洞 扫描错误配置或已知弱...

OpenMetadata - Authentication Bypass

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

CVE-2026-29000-Lab

CVE-2026-29000 — Laboratorio PoC a nivel de librería para pac4j-jwt TL;DR Este repositorio contiene un PoC a nivel de librería para CVE-2026-29000 en pac4j-jwt. Compara el comportamiento vulnerable y el corregido con dos casos: Caso base : un token legítimo debe ser aceptado Ataque : un token...

CVE-2026-30863-Exploit

CVE-2026-30863 – Validación de audiencia JWT en Parse Server Versiones afectadas Parse Server 8.6.10 y 9.5.0-alpha.11 Componentes vulnerables Adaptador de autenticación de Google GoogleAuthAdapter Adaptador de autenticación de Apple AppleAuthAdapter Adaptador de autenticación de Facebook...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken nunca vuelve a validar el estado de la cuenta Producto: go-shiori/shiori Archivo: internal/domains/auth.go CWE: CWE-613 — Expiración de sesión insuficiente CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 Alta CNA: Turan Security · registro CVE Descripci...

CVE-2026-66908

CVE-2026-66908 — camel-platform-http-main: no se validan iss/aud de JWT Reproductor de prueba de concepto ejecutable para la vulnerabilidad de Apache Camel en la que el servidor HTTP embebido de camel-main crea su autenticador JWT únicamente a partir de un almacén de claves cuando no se configura...

CVE-2026-66908

A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...

DEBIAN-CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

CVE-2026-66908

Apache Camel Platform HTTP Main component (versions 4.8.0 through 4.21.x ) silently skipped validation of the iss and aud JWT claims when neither jwtIssuer nor jwtAudience was configured. The root cause is that JWTAuthenticationConfigurer.buildJwtOptions returned null, causing the Vert.x JWTAuth ...

PT-2026-80920

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

EUVD-2026-58817

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-74240

The CVE concerns Red Hat Quay’s JWT validation for federated robot accounts and SSO, where flawed audience verification and insufficient enforcement of azp and sub allow a token from the same identity provider to bypass security boundaries, potentially leading to unauthorized access where audienc...

CVE-2026-74240

A flaw was found in Red Hat Quay's JWT JSON Web Token validation for federated robot accounts and single sign-on SSO authentication. Multiple issues related to audience verification and the enforcement of azp and sub claims were identified. These flaws could allow an attacker with a validly-signe...

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-10714

The CVE-2026-10714 issue affects FactoryTalk Services Platform (FTSP) . It hinges on a JWT validation bypass where the application does not verify that the JWT algorithm is configured for RSA, allowing an attacker to set the algorithm to "none" and forge tokens. This could enable an authenticated...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the JWT validation process. An attacker can maintain persistent unauthorized access by presenting tokens that omit the exp and iat claims, thereby bypassing session expiration and freshness checks. Thi...

CVE-2026-53776

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validateexp = false in the verifydecode helper within the stdlib JWT verification path. Attackers in possession of a previously issued...

PT-2026-49727

Name of the Vulnerable Software and Affected Versions Perry versions prior to 0.5.1166 Description An issue in the JWT validation process allows remote attackers to bypass token expiration. This occurs because the verify decode helper within the stdlib JWT verification path unconditionally sets...