sign-saboteur

SignSaboteur SignSaboteur es una extensión de Burp Suite para editar, firmar, verificar y atacar tokens firmados. Soporta diferentes tipos de tokens: Django TimestampSigner, ItsDangerous Signer, Express cookie-session middleware, OAuth2 Proxy, Tornado’s signed cookies, Ruby Rails Signed cookies,...

EUVD-2026-76741

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

CVE-2026-90452

CVE-2026-90452 affects a reverse proxy component where requests to an identity-provider service (for token discovery, introspection, and credential exchange) do not verify the IdP's server certificate . An attacker positioned on the network path between the proxy and the identity provider could i...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for...

TokenBreaker

TokenBreaker Token Breaker se centra en 2 vulnerabilidades particulares relacionadas con tokens JWT. None Algorithm RSAtoHMAC Consulte este enlace para conocer más sobre la vulnerabilidad y cómo un atacante puede falsificar los tokens. Pruebe esta vulnerabilidad aquí Uso de TheNone root@kitploit:...

POC-CVE-2018-0114

CVE-2018-0114 POC Cisco node-jose 开源库 0.11.0 之前版本中存在一个漏洞，可能允许未经认证的远程攻击者使用嵌入在令牌中的密钥重新签名令牌。该漏洞是由于 node-jose 遵循了 JSON Web 令牌（JWT）的 JSON Web 签名（JWS）标准。该标准规定，表示公钥的 JSON Web 密钥（JWK）可以嵌入到 JWS 的头部中。然后该公钥被信任用于验证。攻击者可以通过移除原始签名、向头部添加新公钥，然后使用与该 JWS 头部中嵌入的公钥相关联的（攻击者拥有的）私钥对对象进行签名，从而伪造有效的 JWS 对象进行利用。...

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report This post-incident report examines the 2025 supply chain breach targeting Oracle Cloud’s identity and authentication infrastructure. It details how threat actors exploited an unpatched pre-authentication Remote Code Execution vulnerability...

ADFSDump

ADFSDump A C tool to dump all sorts of goodies from AD FS. Created by Doug Bienstock @doughsec while at Mandiant FireEye. This tool is designed to be run in conjunction with ADFSpoof. ADFSdump will output all of the information needed in order to generate security tokens using ADFSpoof. Detailed...

poc-cve-2016-10555

Change the algorithm RS256asymmetric to HS256symmetric - POC CVE-2016-10555 The algorithm HS256 uses the secret key to sign and verify each message. The algorithm RS256 uses the private key to sign the message and uses the public key for authentication. If you change the algorithm from RS256 to...

PT-2026-90521

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

jwt-spoof-tool

jwt-spoof-tool Tool Description : I made this tool for learning purpose and automating jwt token hijacking without depending on using burpsuite the code is well documented and easy to follow Based on CVE-2018-0114 The Vulnerabilty happend because in backend the server check jwk object embeded...

CVE-2026-55040-Mass-Exploit

JWT Token Bypass Exploit for Microsoft SharePoint CVE-2026-55040, CVSS 9.1. Forge authentication tokens using three attack vectors: Algorithm "none" skips signature verification Weak HS256 secrets with brute-force dictionary support RS256 key substitution Impersonate any user including...

CVE-2026-29000

JWT/JWE Authentication Bypass PoC A Proof-of-Concept PoC script demonstrating an authentication bypass vulnerability using JSON Web Tokens JWT and JSON Web Encryption JWE. This tool exploits environments that improperly validate token algorithms by accepting unverified JWTs alg: none wrapped insi...

CVE-2026-29000

CVE-2026-29000 CVE-2026-29000: Critical Authentication Bypass in pac4j-jwt - Using Only a Public Key CVSS 10 pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 Vulnerability Summary CVE-2026-29000 is a critical authentication bypass in the pac4j-jwt library versions 6.0.3 and below. When the...

CVE-2026-29000-Lab

CVE-2026-29000 — pac4j-jwt Library-Level PoC Lab TL;DR This repository contains a library-level PoC for CVE-2026-29000 in pac4j-jwt. It compares vulnerable and patched behavior with two cases: Baseline : a legitimate token should be accepted Attack : a forged token should be accepted on vulnerabl...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt JwtAuthenticator authentication bypass Full buildout: writeup, Java in-process PoC, Python token-forge CLI and library, tests. Summary CVE: CVE-2026-29000 CVSS 10, CWE-347 Affected: pac4j-jwt 4.5.9 / 5.7.9 / 6.3.3 when using JWE + signature config Issue: JWE-wrapped...

PT-2026-89717

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key. Reproduction With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature: OCaml let = Mirage crypto...

cve-2026-29000

CVE-2026-29000 Exploit JWT Authentication Bypass in pac4j-jwt via JWE-wrapped PlainJWT Vulnerability Description CVE-2026-29000 is a critical authentication bypass vulnerability affecting pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability allows remote attackers to forge...

CVE-2026-71801

CVE-2026-71801 affects s-pms SPMS-Server through v1.0 . The root cause is a hardcoded default access token secret embedded in the core configuration file that is neither overridden nor removed in the production environment profile. This allows a remote, unauthenticated attacker to locally forge v...

EUVD-2026-75162

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...