CVE-2025-56643

CVE-2025-56643 CVE-2025-56643 の公開リファレンス – Wiki.js 2.5.307 JWT セッション脆弱性 説明: Requarks Wiki.js 2.5.307 は、ユーザーがログアウトしたときにアクティブな JWT トークンを適切に取り消したり無効にしたりしません。 その結果、以前に発行されたトークンは有効なままであり、ログアウト後もシステムにアクセスするために再利用される可能性があります。 この動作はセッションの整合性に影響を与え、トークンが侵害された場合に不正アクセスを許す可能性があります。...

CVE-2020-24030

CVE-2020-24030 Descripción ForLogic Qualiex v1 y v3 tiene una expiración de token débil. Esto permite la escalada de privilegios remota no autenticada y el acceso a datos sensibles mediante la reutilización de tokens. Fechas importantes Anuncio al proveedor: 2020-07-12 Fecha de divulgación públic...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO 认证绕过 执行摘要 FortiCloud 单点登录（SSO）是注册任何 FortiGate/FortiManager/FortiAnalyzer 后默认启用的功能，其中包含一个严重的认证绕过漏洞。 任何拥有 FortiCloud 账户（免费或付费）的攻击者都可以复用其 SSO 令牌登录其他客户的设备（版本不高于下表所列），而无需知道对方的密码。 利用成功后，攻击者可获得完整的 admin GUI 和 root shell 访问权限，从而能够拦截流量、篡改 VPN 或横向移动进入内部网络。 请立即升级，或在修复前禁用...

CVE-2026-92899: Authentication Bypass by Spoofing

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticat...

CVE-2026-73311

CVE-2026-73311: OAuth2 authorization code replay XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once. What happens The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the cod...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

CVE-2026-102364

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364

The mall4j framework (through version 4.0 ) contains an improper authentication vulnerability because it fails to validate the sysType field in sa-token sessions. This flaw allows storefront customers to authenticate as back-office users by reusing their own session tokens. An attacker who regist...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

PT-2026-102374

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.1.0 through 2.14.0 Description The OKPAlgorithm.from jwk function in jwt/algorithms.py fails to compare the public key derived from d with x during the private-JWK import process. This occurs when an OKP private JWK provides...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — 元钓鱼（Meta-Phishing） Facebook Graph API — OAuth 令牌重用与会话劫持 字段| 值 ---|--- 严重性| 9.6（严重） 攻击向量| 网络 受影响版本| Graph API v18.0 – v20.0 发现者| 𝕍𝕠𝕤𝕤🥷 描述 Facebook Graph API 中存在一个严重漏洞，允许攻击者在多个会话中重用 OAuth 令牌。这可在无需用户交互的情况下实现会话劫持和账户接管。 技术细节 Graph API 未对 OAuth...

EUVD-2026-84951

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...

CVE-2026-19202

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...

PT-2026-97091

Name of the Vulnerable Software and Affected Versions mcp-toolbox-sdk-python affected versions not specified Description A caching flaw in the toolbox-core package allows a Google ID token to be cached and reused across different audiences within the same process. The module-level token cache fai...

CVE-2026-77268: Incorrect Permission Assignment for Critical Resource

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CLEANSTART-2026-PZ14685 Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused

Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” login MFA rate limits could be bypassed and TOTP tokens could be reused...

CVE-2026-78426

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...

EUVD-2026-81414

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...

CVE-2026-78426 Logout bypass via alternate JWT spelling

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token...

CVE-2026-78426

NeuVector 's JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid, non-expired JWT that was already used to log out of NeuVector can continue using the token by altering the spelling of the signature field, bypassing the logout mechani...