120 matches found
CVE-2023-50387
CVE-2023-50387 KeyTrap in DNS CVE-2023-50387 This repository is for educational purposes. The number of keys and signatures has been intentionally kept low to prevent their use in actual attacks, and a script for generating colliding keys are not included. Test Setting up the PoC environment...
CVE-2026-68513
A flaw was found in PyOpenEXR, a component of OpenEXR. A heap buffer overflow can occur when processing a specially crafted EXR image file. This vulnerability is triggered by a channel-name key collision between literal and prefixed RGB channels, causing the software to write data beyond the...
json-interop-vuln-labs
JSON Interoperability Vulnerability Labs Description These are the companion labs to my research article "An Exploration of JSON Interoperability Vulnerabilities". Lab 1: Free purchases in an E-commerce Application Key Collision Attacks: Inconsistent Duplicate Key Precedence Inconsistent Large...
CVE-2026-92133
Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...
CVE-2026-35030-PoC
CVE-2026-35030 — LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision LiteLLM OIDC userinfo cache uses token:20 as the cache key. Two different JWTs signed with the same algorithm produce identical first 20 characters , allowing an unauthenticated attacker to inherit another user's...
CVE-2026-55866 SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
EUVD-2026-77689
SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, SpiceDB can return PERMISSIONSHIPHASPERMISSION instead of PERMISSIONSHIPCONDITIONALPERMISSION or PERMISSIONSHIPNOPERMISSION because checkRequestToKey and...
EUVD-2026-77529
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
PT-2026-91226
Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...
grafana: Grafana: Session takeover via Auth Proxy cache key collision
On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...
BIT-GRAFANA-2026-14199 Session takeover via Auth Proxy cache key collision
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...
Linux Distros Unpatched Vulnerability : CVE-2026-14199
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key...
CVE-2026-14199
On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...
CVE-2026-14199
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...
EUVD-2026-70198
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...
CVE-2026-14199 Session takeover via Auth Proxy cache key collision
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...
CVE-2026-14199 Session takeover via Auth Proxy cache key collision
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...
CVE-2026-14199
CVE-2026-14199 affects self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl > 0). The root cause is that the Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter , allowing distinct identities to co...
PT-2026-84754
Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Self-managed instances using Auth Proxy authentication with identity caching enabled where sync ttl is greater than zero are susceptible to an authentication bypass. The issue occurs because...
Session takeover via Auth Proxy cache key collision
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...