CVE-2026-75491

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an authentication bypass in the Mosquitto plugin auth_plugin_jwt.so . The root cause is the acceptance of unsigned JSON Web Tokens (JWTs) using the alg none algorithm. Attackers possessing any Cudy-trusted client certificate can authentic...