5 matches found
CVE-2026-30863-Exploit
CVE-2026-30863 – Parse Server JWT ऑडियंस सत्यापन प्रभावित संस्करण Parse Server 8.6.10 और 9.5.0-alpha.11 कमजोर घटक Google प्रमाणीकरण एडाप्टर GoogleAuthAdapter Apple प्रमाणीकरण एडाप्टर AppleAuthAdapter Facebook प्रमाणीकरण एडाप्टर FacebookAuthAdapter मूल कारण जब एडाप्टर को ऑडियंस पैरामीटर Google/App...
CVE-2026-14541
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...
CVE-2026-55669 ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validates a token's signature and issuer iss but not the audience aud claim, allowing a validly signed token from a trusted issuer for another relying party to be accepted ...
GHSA-G5H5-M4HM-XJRR ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
Summary An authentication bypass vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation. When validating JSON Web Tokens JWTs from an external provider, ZITADEL properly checks the token's cryptographic signature and issuer iss, but it fails to validate the...
