nebula-mesh: Operator session tokens stored in plaintext in the database

Impact Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. - internal/models/operator.go:61 — OperatorSession.Token holds the plaintext...

GHSA-Q4VM-PQ3Q-8WGQ nebula-mesh: Operator session tokens stored in plaintext in the database

Impact Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. - internal/models/operator.go:61 — OperatorSession.Token holds the plaintext...

CVE-2025-64097

NervesHub (OTA firmware management service) is affected by CVE-2025-64097 due to tokens used for user/API authentication having a predictable format from 1.0.0 up to 2.3.0. The root cause is insufficient entropy in tokens, allowing brute-forcing to gain unauthorized access to user accounts or API...

PT-2026-3943

NervesHub is a web service that allows users to manage over-the-air OTA firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens...

EUVD-2020-26025

Malware in sbrugna...

CVE-2023-46660

Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token...