83 matches found
jwt_tool
El kit de herramientas JSON Web Token v2 jwttool.py es un kit de herramientas para validar, forjar, escanear y manipular JWTs JSON Web Tokens. Su funcionalidad incluye: Comprobar la validez de un token Probar exploits conocidos: CVE-2015-2951 La vulnerabilidad de omisión de firma alg=none...
ClaimJumper
root@kitploit: / | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability...
cs50-cyber-paloalto-oauth
CS50 Cybersecurity Final Project Title: The Salesloft OAuth Breach & CVE-2024-3400 Palo Alto impact Author: Yafiya Darwesh GitHub: Yafiah-Darwesh YouTube video: https://youtu.be/CxQNj9qWoZ0?si=cHCwuTIY26YHJ8aw CVE: CVE-2024-3400 Files presentation.pdf — slides script.txt — speaker notes Summary...
EUVD-2026-70668
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-54363
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
EUVD-2026-51099
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
CVE-2026-54363
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
PT-2026-66591
Name of the Vulnerable Software and Affected Versions Outstatic CMS versions prior to 2.2.0 Description The application contains a hardcoded JSON Web Token JWT signing secret. If the OST TOKEN SECRET environment variable is not configured, the system uses a default secret available in the public...
CVE-2026-7872 Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass
IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user...
CVE-2026-7872
Summary: The vulnerability CVE-2026-7872 affects Langflow OSS 1.0.0–1.10.0, via a path traversal flaw in the File component’s tar archive extraction. An authenticated attacker can craft a tar with symbolic links, bypassing validation and causing extraction to create links outside the intended dir...
CVE-2026-54733
The Moodle integration for Microsoft 365/Entra ID (local_o365) is vulnerable prior to 4.5.6, 5.0.5, and 5.1.1. The Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users based on the upn claim without verifying the JWT signature, enabling an unauthenticated attacker...
CVE-2026-56451
A vulnerability has been identified in Opcenter X All versions V2604. Affected applications do not properly validate the algorithm specified in the JSON Web Token JWT header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersona...
PYSEC-2026-2507 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
Summary The ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional co...
CVE-2026-50160
Hoppscotch self-hosted deployments (Hoppscotch-backend
EUVD-2026-38170
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected...
CVE-2026-48526
A flaw was found in PyJWT, a Python library for JSON Web Token JWT implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys JWK in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the...
Unintended Proxy or Intermediary ('Confused Deputy')
Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the uri parameter being passed directly to urllib.request.urlopen, which allows fetching resources using unsupported schemes such as file, ftp, and data. An attacker can access...
CVE-2021-47942
CVE-2021-47942 concerns Home Assistant Community Store (HACS) 1.10.0. The vulnerability is a path traversal flaw exposed via the /hacsfiles/ endpoint, allowing unauthenticated attackers to read sensitive files (notably .storage/auth) and retrieve credentials/refresh tokens. With this access, an a...
CVE-2026-6911
Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...
