106 matches found
jwt_tool
Le kit d'outils JSON Web Token v2 jwttool.py est une boîte à outils pour valider, forger, scanner et falsifier les JWT JSON Web Tokens. Ses fonctionnalités incluent : Vérifier la validité d'un jeton Tester les exploits connus : CVE-2015-2951 La vulnérabilité de contournement de signature alg=none...
CVE-2026-71206-PoC
CVE-2026-71206 — Shiori: CheckToken для JWT никогда не проверяет состояние учётной записи повторно Продукт: go-shiori/shiori Файл: internal/domains/auth.go CWE: CWE-613 — Недостаточный срок действия сеанса Insufficient Session Expiration CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 Высокий...
CVE-2026-66908
CVE-2026-66908 — camel-platform-http-main: JWT iss/aud не проверяются Рабочий proof-of-concept для воспроизведения уязвимости Apache Camel, в которой встроенный HTTP-сервер camel-main строит свой JWT-аутентификатор только на основе хранилища ключей, когда не настроены ни jwtIssuer, ни jwtAudience...
Security Bulletin: Multiple Vulnerabilities in IBM Event Streams
Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.3 Vulnerability Details CVEID:CVE-2026-33557 DESCRIPTION: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to...
OpenMetadata - Authentication Bypass
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...
CVE-2026-29000-Lab
CVE-2026-29000 — PoC-лаборатория на уровне библиотеки pac4j-jwt TL;DR Этот репозиторий содержит PoC на уровне библиотеки для CVE-2026-29000 в pac4j-jwt. Он сравнивает уязвимое и исправленное поведение на двух сценариях: Базовый сценарий : легитимный токен должен быть принят Атака : подделанный...
CVE-2026-30863-Exploit
CVE-2026-30863 – Проверка аудитории JWT в Parse Server Затронутые версии Parse Server 8.6.10 и 9.5.0-alpha.11 Уязвимые компоненты Адаптер аутентификации Google GoogleAuthAdapter Адаптер аутентификации Apple AppleAuthAdapter Адаптер аутентификации Facebook FacebookAuthAdapter Основная причина Когд...
CVE-2026-100608 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...
CVE-2026-100608 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...
CVE-2026-93556
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the...
EUVD-2026-84341
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the...
PT-2026-95825
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the OpenID Connect OIDC protocol implementation. During the token refresh process, the server restores requested audiences from stored client IDs but fails to verify if the...
About Authentication Bypass - Microsoft SharePoint (CVE-2026-55040) vulnerability
About Authentication Bypass - Microsoft SharePoint CVE-2026-55040 vulnerability. SharePoint is a web application for corporate intranet portals, document management, and collaboration. This vulnerability was disclosed as part of the July Microsoft Patch Tuesday. A remote unauthenticated attacker...
SUSE CVE-2026-53471
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens JWTs for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the sourceid claim within these tokens against the requested source ID. This oversight allows an...
CVE-2026-66908
A flaw was found in the Apache Camel Platform HTTP Main component. When JSON Web Token JWT authentication is configured with a keystore but without specifying an issuer or audience, the system fails to validate the 'iss' and 'aud' claims. This improper authentication allows an attacker to use any...
PT-2026-81231
The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...
DEBIAN-CVE-2026-75509
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...
CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...
CVE-2026-66908
The Apache Camel Platform HTTP Main component (versions 4.8.0 to before 4.22.0) contains an improper authentication vulnerability. When JWT authentication is enabled with a keystore but without jwtIssuer or jwtAudience configurations, the camel-main embedded HTTP server fails to validate the iss ...
