100 matches found
jwt-key-confusion-poc
PoC de confusión de claves JWT CVE-2015-9235 Escrito para los desafíos de Hack the Box - Under Construction y Secret Ambos scripts incluidos realizan un ataque de confusión de claves de Java Web Token CVE-2015-9235. Para realizar el ataque, se requiere que el atacante conozca la clave pública que...
jwtXploiter
jwtXploiter 一个用于测试 JSON Web Token 安全性的工具。 测试 JWT 是否受到所有已知 CVE 的影响； 篡改令牌载荷：更改声明和子声明的值。 利用已知存在漏洞的头部声明（kid、jku、x5u） 验证令牌 检索目标 SSL 连接的公钥，并尝试仅用一个选项在密钥混淆攻击中使用它 支持所有 JWA 生成一个 JWK 并将其插入令牌头部 还有更多功能！ Wiki 阅读维基！ wiki 安装 注意：除开发目的外，应避免克隆仓库！ 注意：Deb 软件包应视为测试版 通过 rpm： root@kitploit: wget...
poc-cve-2016-10555
将算法从 RS256（非对称）改为 HS256（对称）- POC（CVE-2016-10555） HS256 算法使用密钥来签名和验证每条消息。 RS256 算法使用私钥签名消息，并使用公钥进行身份验证。 如果将从 RS256 改为 HS256，后端代码将把公钥作为密钥，然后使用 HS256 算法验证签名。 致谢： https://www.youtube.com/c/FarahHawa...
CVE-2015-9235_JWT_key_confusion
英文 描述 此应用程序允许您替换 JSON Web 令牌 JWT 中的值，并使用 HMAC-SHA256 方法重新计算签名。它接受一个令牌、一个要替换的键以及与该键关联的新值作为输入。 用法 克隆或下载应用程序的源代码。 root@kitploit: git clone https://github.com/WinDyAlphA/CVE-2015-9235JWTkeyconfusion cd CVE-2015-9235JWTkeyconfusion 文件 token.txt 包含一个有效的 JWT 令牌作为示例。您可以修改它或将其替换为您自己的令牌。...
CVE-2018-0114-PoC
CVE-2018-0114 PoC 为 PentesterLab 编写了这个 如果你来自 PentesterLab，不要作弊，学习会更好。 希望它对某人有帮助，如果没有，那就留待将来我自己用吧 : 示例 root@kitploit: $ python3 script.py Making keys... 'alg': 'RS256', 'jwk': 'kty': 'RSA', 'kid': '[email protected]', 'use': 'sig', 'n':...
POC_CVE-2015-9235
CVE-2015-9235 演示针对 JSON Web Token JWT 库的算法混淆攻击。JWT 通常用于 Cookie 中认证用户会话，因此该攻击至关重要。使用 Node 模块 [email protected] 来展示此漏洞。 该项目也是一次愉快的 vibe coding 活动，因为前端（除 API 调用外）几乎完全由 LLM 完成。 漏洞 JWT 的格式如下： root@kitploit: b64header.b64payload.b64signature 在我们的场景中： header = algorithm, type payload = username, ro...
EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3714)
According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...
Astra Linux – Vulnerability in ujson
UltraJSON is a fast JSON encoder and decoder written in pure C, with bindings for Python 3.7+. It was found that affected versions incorrectly decoded certain characters. JSON strings containing escaped surrogate characters that were not part of a valid surrogate pair were decoded incorrectly. Th...
NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)
The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...
CVE-2020-7494
creationtimestamp| type| source ---|---|--- 2026-09-01 17:01:12+00:00| seen| https://t.me/cissp/1528 2026-09-02 01:05:01+00:00| seen| https://t.me/cissp/1528 2026-09-12 01:00:05+00:00| published-proof-of-concept| https://t.me/cissp/1528 2026-09-13 00:01:01+00:00| published-proof-of-concept|...
CVE-2026-58432
The Gitea version running on FreeBSD is susceptible to multiple security issues, including missing authorization and authorization bypass through user-controlled keys. These flaws, along with incorrect permission assignments for critical resources, can lead to the exposure of sensitive informatio...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Next.js (CVE-2025-57752 and CVE-2025-55173)
Summary The vulnerabilities CVE-2025-57752 Cache Key Confusion / Cache Deception and CVE-2025-55173 Content Injection / Arbitrary File Delivery in the Next.js framework have been completely resolved by upgrading the dependency from version 14.2.26 to 15.5.15. Vulnerability Details...
CVE-2026-33496
ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The oauth2introspection authenticator cache does not distingui...
CVE-2026-33496 Ory Oathkeeper has an authentication bypass by cache key confusion
ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The oauth2introspection authenticator cache does not distingui...
CVE-2026-33496
ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The oauth2introspection authenticator cache does not distingui...
CVE-2026-33496
Overview: CVE-2026-33496 affects ORY Oathkeeper (Identity & Access Proxy) prior to version 26.2.0, where the oauth2_introspection authenticator cache fails to distinguish tokens across different introspection URLs, enabling authentication bypass via cache key confusion. Impact (as described): An ...
CVE-2026-33496 Ory Oathkeeper has an authentication bypass by cache key confusion
ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The oauth2introspection authenticator cache does not distingui...
Ory Oathkeeper 安全漏洞
Ory Oathkeeper is an access control decision-making software developed by Ory OpenSource. Versions of Ory Oathkeeper prior to 26.2.0 contained security vulnerabilities. These vulnerabilities were caused by a cache key confusion in the oauth2introspection authentication mechanism, which could lead...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication due to cache key confusion. An attacker can gain unauthorized access by using a token to prime the cache, and subsequently use the same token for rules that use a different introspection server. Note: This is onl...