GHSA-V77H-2W3M-94HX ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

PT-2026-6752

Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.12.1 Description The administrative dashboard reveals each user’s long-lived API key within the HTML and JavaScript code on every login. This exposes permanent API credentials to any script operating within the...

CVE-2025-70963

Gophish =0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context...

GoPhish security vulnerabilities

GoPhish is an open-source phishing framework developed by GoPhish. Versions of GoPhish 0.12.1 and earlier contain security vulnerabilities. These vulnerabilities stem from improper access control mechanisms. In these versions, the management panel exposes the user’s long-term API keys directly in...

CVE-2023-35941

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios ...

Envoy security vulnerabilities

Envoy is an open source distributed proxy server. Envoy suffers from a security vulnerability that stems from the ability of a malicious client to construct permanently valid credentials in certain specific scenarios...

CVE-2023-35941: Improper Encoding or Escaping of Output

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios ...