CVE-2023-4696

CVE-2023-4696 Toma de Control de Cuenta Debido al Manejo Inadecuado de Tokens JWT en memos v0.13.2 Descripción Quiero arrojar luz sobre una vulnerabilidad de seguridad significativa que descubrí recientemente en el sistema usememos/memos. Esta vulnerabilidad tiene el potencial de permitir que...

CVE-2022-39227

CVE-2022-39227 CVE-2022-39227 : 概念验证 此 CVE-2022-39227 的概念验证代码。根据该CVE，JSON Web Token验证存在缺陷。可以通过有效的令牌，利用其签名与修改后的声明一起使用。 所需条件： 1. 一个有效的JSON Web Token。 2. 后端使用的是版本低于 3.3.4 的 Python 库 "python-jwt"。 为了方便使用，我在一次CTF中编写了一个简单的PoC： usage: CVE-2022-39227-PoC -h -j TOKEN -i CLAIM Proof of Concept for the JWT...

CVE-2026-29000

CVE-2026-29000 — Bypass de autenticación JWE en pac4j-jwt Laboratorio CTF para investigar la vulnerabilidad de autenticación JWE en la librería pac4j-jwt CVSS 9.3 Crítico · CWE-287 · Afecta: pac4j-jwt ← acceso al panel de administración ↓ Leer datos sensibles: lista de empleados, configuración de...

kit-jwt

kit-jwt 用于Kit的JSON Web Token JWT 编码与解码 TOC 文件 文件| 描述 ---|--- .editorconfig| 编辑器格式配置 .gitignore| 构建产物和依赖的Git忽略规则 .tool-versions| asdf工具版本（Zig, Kit） LICENSE| MIT许可证文件 README.md| 本文件 examples/basic.kit| 基本HS256使用示例 kit.toml| 包含元数据、功能和依赖的包清单 src/jwt.kit| JWT编码、解码、验证和辅助API zig/jwtrsa.zig|...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 are vulnerable to an authentication bypass due to the use of a hard-coded constant for JWT verification in the realtime WebSocket and SSE service . This flaw occurs specifically when the AISOC_REALTIME_JWT_SECRET environment variable is not configured. Unauthent...

EUVD-2026-89539

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

EUVD-2026-83263

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...

CVE-2026-14916

A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside Kong API Gateway Enterprise. The affected code does not properly validate that the JWT signing algorithm is compatible with the type of key used for...

BIT-CONTOUR-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-19505 RDK-B WebUI improper cryptographic signature verification vulnerability

Improper cryptographic signature verification in jstfunctions.c in RDK-B WebUI rdkb-2025q4-kirkstone.04.10.26 allows a remote attacker to bypass authentication and obtain administrative access via a forged JWT containing an invalid RSA signature...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-50149 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-50149: Improper Certificate Validation

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...

CVE-2026-55165

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-55165 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

EUVD-2026-61146

Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetchtokenheader to read headerdata"alg" from an unverified token and passed that attacker-controlled value to decodewithmultiplesecrets. PyJWT 2.x rejects alg=none with the configured...

CVE-2026-18500

CVE-2026-18500 concerns the @fastify/jwt plugin for Fastify. In versions before 10.2.2, a per-request key passed to request.jwtVerify({ key }) can be silently overridden by the plugin’s globally configured secret due to the option merge applying the global key last. This allows an ordinary authen...

EUVD-2026-59757

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify key is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different...