badsecrets

badsecrets A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various "known secrets" for example, ASP.NET machine keys found in examples in tutorials, and to provide a...

CVE-2025-55449

CVE-2025-55449 - Vulnérabilité d'Exécution de Code à Distance RCE dans AstrBot Aperçu Ce dépôt contient un exploit de preuve de concept pour CVE-2025-55449 , une vulnérabilité critique d'Exécution de Code à Distance RCE dans AstrBot. La vulnérabilité permet à un attaquant d'exécuter du code...

jwt-cracker

jwt-cracker Simple HS256, HS384 & HS512 JWT token brute force cracker. Effective only to crack JWT tokens with weak secrets. Recommendation : Use strong long secrets or RS256 tokens. Install With npm: root@kitploit: npm install --global jwt-cracker Usage From command line: root@kitploit:...

the-same-key-opens-every-box-cve-2026-71960-hard-coded-jwt-secret-in-cudy-wr3000-mesh-mqtt

CVE-2026-71960 — жёстко заданный секрет JWT в MQTT-брокере Cudy WR3000 2.0 Mesh PoC-инструментарий для статьи Hunt-Benito "Один и тот же ключ открывает каждое устройство: CVE-2026-71960 — жёстко заданный секрет JWT в MQTT-брокере Cudy WR3000 Mesh"...

CVE-2026-86195

grav-plugin-api versions 1.0.0 through 1.0.19 contain a privilege escalation vulnerability in the InvitationsController . The stripSuperFlags() method removes nested super flags but fails to strip dot-keyed equivalents such as api.super . A non-super user with api.access and api.users.write permi...

c-jwt-cracker

JWT cracker A multi-threaded JWT brute-force cracker written in C. If you are very lucky or have a huge computing power, this program should find the secret key of a JWT token, allowing you to forge valid tokens. This is for testing purposes only, do not put yourself in trouble : I used the Apple...

CVE-2025-56643

CVE-2025-56643 Référence publique pour CVE-2025-56643 – Wiki.js 2.5.307 Vulnérabilité de session JWT Description : Requarks Wiki.js 2.5.307 ne révoque pas correctement ou n'invalide pas les jetons JWT actifs lorsqu'un utilisateur se déconnecte. En conséquence, les jetons précédemment émis restent...

CVE-2026-29000

CVE-2026-29000 Lab مختبر Java/SparkJava يحاكي ثغرة التحقق من JWT/JWE المتعلقة بـ CVE-2026-29000. يعمل التطبيق على المنفذ 4567 ويوفر واجهات برمجية API لتجربة تدفق تسجيل الدخول الصحيح، إنشاء رمز مزيف، والتحقق من لوحة التحكم dashboard. معلومات عن CVE يؤثر CVE-2026-29000 على pac4j-jwt في الإصدارات...

AzTokenFinder

AzTokenFinder Est un petit outil pour extraire des JWT ou des données ressemblant à des JWT de différents processus, comme PowerShell, Excel, Word ou autres. L'idée a été inspirée de l'article de blog https://mrd0x.com/stealing-tokens-from-office-applications/ de l'incroyable @mrd0x. Dans la...

CVE-2026-13447

The MStore API WordPress plugin (versions ≤ 4.20.0) is vulnerable to an unauthenticated authentication bypass via JWT forgery. The root cause lies in FirebasePhoneAuthHelper::verify_id_token(), which validates Firebase ID token claims (alg, kid, aud, iss) but never verifies the JWT cryptographic ...

CVE-2026-13447 MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

EUVD-2026-71838

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verifyidtoken function, which decodes and validates Firebase ID token...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

jwt_tool

The JSON Web Token Toolkit v2 jwttool.py is a toolkit for validating, forging, scanning and tampering JWTs JSON Web Tokens. Its functionality includes: Checking the validity of a token Testing for known exploits: CVE-2015-2951 The alg=none signature-bypass vulnerability CVE-2016-10555 The RS/HS25...

PT-2026-86308

Name of the Vulnerable Software and Affected Versions Mstore Api plugin for WordPress versions prior to 4.20.1 Description An authentication bypass exists due to JWT JSON Web Token forgery. The issue occurs in the FirebasePhoneAuthHelper::verify id token function, which validates token claims suc...

CVE-2025-68860

WordPress Mobile Builder = 1.4.2 - Authentification cassée CVE-2025-68860 Description Le plugin WordPress Mobile builder version 1.4.2 et inférieures présente une vulnérabilité d'authentification cassée qui permet à un attaquant de créer un token JWT valide avec le secret par défaut "examplekey" ...

CVE-2026-82329

CVE-2026-82329 — Обход аутентификации без учетных данных в JFrog Artifactory массовая эксплуатация -red.svg Критический обход аутентификации CVSS 9.8 — активно эксплуатируется в дикой природе Этот инструмент представляет собой массовый эксплойт для CVE-2026-82329 — уязвимости, которая позволяет...

some-tweak-to-hide-jwt-payload-values

some-tweak-to-hide-jwt-payload-values a handful of tweaks and ideas to safeguard the JWT payload, making it futile to attempt decoding by constantly altering its value, ensuring the decoded output remains unintelligible while imposing minimal performance overhead. What is a JWT Token? A JSON Web...

WordPress MStore API plugin <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery vulnerability

Unauthenticated Authentication Bypass via 'idtoken' Parameter JWT Forgery vulnerability discovered by t4g0 in WordPress Plugin MStore API versions = 4.20.0...

CVE-2026-82329-poc

CVE-2026-82329 Outil d'évaluation de sécurité Artifactory PoC et outil de validation pour identifier les installations JFrog Artifactory auto-hébergées affectées par CVE-2026-82329. Cet outil valide la chaîne d'authentification suivante : 1. Crée un JWT HS256 de jonction en utilisant la clé de...