11 matches found
CVE-2026-115933
The Postiz application is vulnerable to a critical flaw where it signs session, invitation, and password reset tokens using a single shared secret without specifying the token's purpose. A specific route refreshing browser-extension channel credentials allows users to submit signed data from a re...
CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can...
CVE-2026-1529
CVE-2026-1529 Keycloak Exploit Tool CVE-2026-1529 : Keycloak - Unauthorized organization registration via improper invitation token validation ⚠️ WARNING : This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. 📋 Table of...
Insertion of Sensitive Information Into Sent Data
Overview @keycloak/keycloak-admin-ui is a This project is the next generation of the Keycloak Admin UI. It is written with React and PatternFly 4 and uses Vite. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through...
Insertion of Sensitive Information Into Sent Data
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through OrganizationInvitationResource.toRepresentation in...
CVE-2026-54320 Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted and declined by a user whose email matched the invitation but had not been verified. Daytona authenticates users via OIDC and...
CVE-2026-54320
CVE-2026-54320 refers to Daytona’s cross-tenant takeover vulnerability prior to version 0.184.0. The issue allowed an unverified email that matched an invitation’s target to accept it (or decline) and join the target organization, since invitation acceptance/declination did not require email veri...
CVE-2026-54320 Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted and declined by a user whose email matched the invitation but had not been verified. Daytona authenticates users via OIDC and...
org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token JWT payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an...
CVE-2025-66223: Insufficient Session Expiration
OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issue...
