CVE-2025-45769

php-jwt v6.11.0 is identified in multiple sources (GHSA-2X45-7FC3-MXWQ, OSV:GHSA-2X45-7FC3-MXWQ) as containing weak encryption, with reports noting potential token manipulation. The CVE entry notes a cryptographic weakness and a dispute regarding its severity. Connected documents confirm the affe...

CVE-2025-45770

jwt v5.4.3 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an application, not by this library. This dispute is subject to review under CNA rules 4.1.4, 4.1.14, and other rules; the dispute tagging is not meant ...

CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

CVE-2024-48916

CVE-2024-48916 affects Ceph’s RadosGW OIDC provider used by IBM Storage Ceph. In versions 19.2.3 and below, it is possible to submit a JWT with the alg set to “none,” causing the signature to be unchecked (authentication bypass). IBM’s bulletin lists affected IBM Storage Ceph versions: 6.0, 6.1z0...

CVE-2024-48916 Ceph is vulnerable to authentication bypass through RadosGW

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

CVE-2024-48916 Ceph is vulnerable to authentication bypass through RadosGW

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

RLSA-2025:3411 Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 For more details about the security issues, including the impact, a CVSS score,...

opentelemetry-collector security update

An update is available for opentelemetry-collector. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Collector with the supported components for a Rocky Enterpris...

RLSA-2025:3344 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 For more details about the security issues, including the impact, a CVSS...

GO-2025-3812 File Browser’s insecure JWT handling can lead to session replay attacks after logout in github.com/filebrowser/filebrowser

File Browser’s insecure JWT handling can lead to session replay attacks after logout in github.com/filebrowser/filebrowser...

CVE-2025-40680

Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text within different registry keys on the Windows operating system. Any authenticated local user with read access to the registry can extract the...

CVE-2025-0249

HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization...

CVE-2025-0249

HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization...

CVE-2025-0249

CVE-2025-0249 affects HCL IEM with an improper invalidation of access or JWT tokens. The root cause is a token not being invalidated, potentially allowing unauthorized access to sensitive data. Public details in the provided documents indicate information disclosure risk (confidentiality impact) ...

CVE-2025-40680

CapillaryScope v2.5.0 (Capillary io) stores proxy credentials and the JWT session token in plain text in Windows registry keys. This exposes sensitive data to any authenticated local user with registry read access, as noted across multiple sources (NVD/Red Hat/CIRCL/CVE records). The root cause i...

Use Of Hard-coded Credentials

@haxtheweb/haxcms-nodejs is vulnerable to Use of Hard-coded Credentials. The vulnerability is due to hardcoded default credentials and JWT private keys, followed by the lack of prompts or UI options to change them, which allows an attacker to gain unauthorized access to user or superuser accounts...

Improper Authentication

@haxtheweb/haxcms-nodejs is vulnerable to improper authentication. The vulnerability is due to an insecure default configuration in the NodeJS backend that disables JWT checks by default, which allows an attacker to gain unauthorized access if the server is deployed without modifying these defaul...

CVE-2025-51864

A reflected cross-site scripting XSS vulnerability exists in AIBOX LLM chat chat.aibox365.cn through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens...

PT-2025-30662 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: CapillaryScope version 2.5.0 Description: The software lacks sensitive data encryption, storing proxy credentials and the JWT session token in plain text within Windows registry keys. Any authenticated local user with read access to the...

CVE-2025-54137

HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change...