Koh

Koh Koh is a C and Beacon Object File BOF toolset that allows for the capture of user credential material via purposeful token/logon session leakage. Some code was inspired by Elad Shamir's Internal-Monologue project no license, as well as KB180548. For why this is possible and Koh's approeach, s...

CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...

CVE-2026-102981 Plane: Unauthenticated Workspace Invitation Token Leakage

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/slug/invitations/pk/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and throu...

CVE-2026-102981

The open-source project management tool Plane is vulnerable to an unauthenticated workspace invitation token leakage in versions prior to 1.4.0 . The issue exists in the WorkspaceJoinEndpoint , where the WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and via the get_...

PT-2026-111172

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to...

CVE-2026-107811

The Nginx UI web interface for the Nginx web server is vulnerable in versions 2.0.0 through 2.5.0 . Authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which serialize and leak the node token field. An attacker can use this token as the X-Node-Secret header to bypass authe...

CVE-2025-51471-POC

CVE-2025-51471 - Ollama Cross-Domain Token Exposure PoC Author: ajtazer 🔥 Overview This repository contains a Proof of Concept PoC for CVE-2025-51471 , a Cross-Domain Authentication Token Exposure vulnerability that affects all versions of Ollama including the latest. 📋 Vulnerability Description...

CVE-2026-41940

CVE-2026-41940 Auto Exploit Overview CVE-2026-41940 is a proof-of-concept PoC exploit targeting cPanel/WHM. This exploit demonstrates an unauthenticated authentication bypass using CRLF injection to leak security tokens and gain root-level access to the WHM interface, allowing for actions such as...

cPanelWHM-AuthBypass

cPanel/WHM Auth Bypass Scanner & Exploit Tool A Go command-line tool rewritten from the Python PoC by watchTowr, used to detect and exploit the CVE-2026-41940 cPanel/WHM authentication bypass vulnerability. Vulnerability Overview CVE-2026-41940 is an authentication bypass vulnerability in...

EUVD-2026-87369

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token...

CVE-2026-105396

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396 Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

EUVD-2026-92414

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

CVE-2026-105396: Origin Validation Error

Heym before v0.0.112 contains a token leakage vulnerability in buildpublicbaseurl that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

PT-2026-104811

Heym before v0.0.112 contains a token leakage vulnerability in build public base url that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers. Attackers can trigger anonymous workflows with forged headers so reviewer notifications point to...

GO-2026-6553 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao

OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao...

CVE-2026-103259

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

EUVD-2026-90653

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259

The n8n application versions before 2.39.6 and 2.40.x before 2.40.1 are vulnerable to a session token leakage in the Dynamic Credentials authorize and revoke endpoints. Attackers who possess resolver registration capability can capture collaborators' session tokens by configuring a fallback resol...

BIT-OPENBAO-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...