jwt-key-id-injector

जेडब्ल्यूटी की आईडी इंजेक्टर एक सरल पायथन स्क्रिप्ट जो काल्पनिक JWT भेद्यता के विरुद्ध जाँच करती है। मान लीजिए कि एक एप्लिकेशन है जो HS256 एल्गोरिदम से हस्ताक्षरित JWT टोकन का उपयोग करता है। एक उदाहरण टोकन इस प्रकार दिखता है:...

CVE-2026-65599: Cleartext Storage of Sensitive Information

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field intended only for a key identifier. Because JWT headers are Base64-encoded...

The vulnerability of the Dovecot mail server, related to errors in the encapsulation fields kid and azp in JWT tokens, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server is related to errors in the encapsulation of fields “kid” and “azp” in JWT tokens. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

PT-2019-7246

Name of the Vulnerable Software and Affected Versions mod ucam webauth versions prior to 2.0.2 Description A Directory Traversal issue was discovered, allowing an attacker to manipulate the kid field in the IdP's HTTP response message, specifically the "WLS-Response". The kid field, which should...