CVE-2025-0326 Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's...

CVE-2025-0326

The WSO2 Identity Server contains a vulnerability where the system fails to invalidate existing access tokens for sub-organization users during sensitive account management operations, such as password resets , role changes , or sub-organization disablement . This improper token revocation allows...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Arbitrary API Token Revocation Leading to Denial of Service NVD • Advisory • CWE-639 Overview The DELETE /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user with editor privileges or above to revoke API tokens belonging...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken Never Re-Validates Account State Product: go-shiori/shiori File: internal/domains/auth.go CWE: CWE-613 — Insufficient Session Expiration CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 High CNA: Turan Security · CVE record Description Shiori's CheckToke...

CVE-2026-65173

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service...

CVE-2026-65173

NVIDIA AIStore for Linux is susceptible to a missing authentication vulnerability in its token-revocation endpoint . An unauthenticated remote attacker can exploit this by submitting crafted token-revocation lists. A successful attack may result in data tampering and denial of service . No specif...

CVE-2026-49264

A flaw was found in oauthlib. When JSON with Padding JSONP support is enabled on the token revocation endpoint, the application fails to validate user-supplied callback parameters before reflecting them into the response. A remote attacker could exploit this flaw by submitting a crafted callback...

PT-2026-111521

Name of the Vulnerable Software and Affected Versions NVIDIA AIStore for Linux affected versions not specified Description An authentication flaw exists in the token-revocation endpoint, allowing an unauthenticated remote attacker to submit crafted token-revocation lists. This may result in data...

CVE-2026-109342

SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to a missing authentication flaw in the revoke RPC method . This allows low-privileged or unauthenticated callers to permanently revoke other users' refresh tokens without proof of possession. Attackers can acquire necessary grant identifiers u...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

EUVD-2026-95034

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw exists in the OIDC Dynamic Client Registration (DCR) component of Keycloak . A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623 Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623: Missing Authorization

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

SummaryPyJWT 2.13.0 accepts compact JWS signature segments containing characters thatare not in the Base64URL alphabet. Appending !!!! to a valid signature doesnot change the decoded signature bytes or authenticated claims, but it changesthe serialized token and its SHA-256 hash. An application...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269 PyJWT: Non-canonical signature segments enable raw-token revocation bypass

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...