CVE-2020-24030

CVE-2020-24030 Description ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and to access sensitive data via token reuse. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...

CVE-2020-24030

CVE-2020-24030 Description ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and to access sensitive data via token reuse. Important Dates Announcement to Vendor: 2020-07-12 Public disclosure date: 2020-08-31 Vulnerability Type Incorrect...

CVE-2026-110024

The @fastify/jwt plugin for Fastify versions prior to 10.2.5 is vulnerable to missing token expiration. The top-level sign and verify methods incorrectly replace global defaults with per-call options instead of merging them. Consequently, providing any per-call option silently drops global tempor...

CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

EUVD-2026-103670

@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does no...

PT-2026-116648

Name of the Vulnerable Software and Affected Versions @fastify/jwt versions prior to 10.2.5 Description In the top-level sign and verify methods, per-call options replace globally configured defaults instead of merging with them. This behavior causes any global default not explicitly restated in...

BIT-GITEA-2026-101023 Gitea OAuth2 refresh token grant accepts access tokens

Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the refreshtoken grant type, but not that the token was a refresh token. An unexpired access token for the same OAuth2 application and grant could be exchanged for a new access token and refresh token. Whoeve...

CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

CVE-2026-67242

A flaw was found in rabbitmq-server. When configured to use OAuth 2.0 authentication, the server does not properly validate token expiration timestamps that are represented as floating-point numbers. A remote attacker with an expired token can exploit this issue to bypass expiration checks, gaini...

GO-2026-6469 ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel

ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GHSA-V77H-2W3M-94HX ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation Specifically, within the validation pipeline, if an incoming JWT omits the exp claim entirely, the expiration block is silently skipped rather than rejected. The token ...

CVE-2026-55513 nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI host-creation path ignores both the server-wide enrollmenttokenttl security setting and per-network networkconfig.enrollmenttokenttl overrides. API host creatio...

EUVD-2026-69722

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php , allowing an attacker who obtains a recovery token to use it indefinitely to reset a target account's password and gain full account access . The vulnerability is network-exploitable with low complex...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...

CVE-2026-84480 WWBN AVideo Password Recovery Token Expiration Bypass

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full...