CVE-2019-20933

CVE-2019-20933 InfluxDB anterior a la versión 1.7.6 tiene una vulnerabilidad de omisión de autenticación en la función authenticate en services/httpd/handler.go porque un token JWT puede tener un SharedSecret vacío también conocido como secreto compartido. see...

CVE-2019-19609

CVE-2019-19609 Strapi Ejecución Remota de Código Uso python3 exploit.py rhost jwt url lhost Exploit POC https://bittherapy.net/post/strapi-framework-remote-code-execution/...

demo-cve-2022-21449

Demo Project: CVE-2022-21449 Vulnerability This project demonstrates the CVE-2022-21449 vulnerability, which affects Java's ECDSA signature verification. The vulnerability allows a malicious actor to bypass signature verification by using a signature with zero values r=0 and s=0. The project uses...

CVE-2025-30144

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

ClaimJumper

/ | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k...

CVE-2018-1002105

CMPT733-Group110x90 CVE-2018-1002105 Miembros : Abhishek Rungta, Shubham Saini, Siddhant Sood Configuración del Entorno Una máquina virtual Linux como Ubuntu 20.04 Minikube para el despliegue local de Kubernetes Cualquiera de estas versiones antiguas 1.0.x— 1.9.x, 1.10.0—1.10.10, 1.11.0—1.11.4,...

JWT-Bruteforcer

JWT-Bruteforcer Basic Jwt Bruteforcer tool with CVE-2018-1000531 Vulnerability Test Imported libraries: jwt base64 Requires minimum version of python 3.6...

BIT-RABBITMQ-2026-66071 RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom to convert to a tag atom. The token signature is...

EUVD-2026-90492

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

CVE-2026-82827 A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_3344)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253344 advisory. golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 Tenable has extracted the preceding description block directly from t...

Rocky Linux 9 [CIQ] Security Update: opentelemetry-collector (crlsa-2025_3411)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20253411 advisory. golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 Tenable has extracted the preceding description block directly from t...

Rocky Linux 8 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc (crlsa-2025_7967)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257967 advisory. golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 Tenable has extracted the preceding description block directly from t...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1746655592)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746655592 advisory. - golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function...

Linux Distros Unpatched Vulnerability : CVE-2026-103001

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable...

GHSA-GVP8-978C-RX2Q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

Modification of Assumed-Immutable Data (MAID)

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID in the mergeoptions method in jwt/apijwt.py, which writes verifyexp, verifynbf, verifyiat, verifyaud, verifyiss, verifysub, and verifyjti directly...

kit-jwt

kit-jwt Codificación y decodificación de JSON Web Token JWT para Kit TOC Archivos Archivo| Descripción ---|--- .editorconfig| Configuración de formato del editor .gitignore| Reglas de ignorado de Git para artefactos de compilación y dependencias .tool-versions| Versiones de herramientas asdf Zig,...

cve-2026-49352-poc

CVE-2026-49352 — 9router Hardcoded JWT Secret Authentication Bypass Table of Contents Overview Affected Versions Root Cause Analysis Repository Structure Requirements Usage Expected Output References Disclaimer Overview CVE-2026-49352 is a vulnerability in 9router, a self-hosted Node.js/Next.js...