CVE-2024-22243

CVE-2024-22243 Author: Sean Pesce This project contains an example web application that demonstrates exploitable scenarios for CVE-2024-22243, a URL-parsing vulnerability in the Java Spring Framework official disclosure here. Vulnerability Affected versions of Spring parse the "userinfo" segment ...

CVE-2026-35030-PoC

CVE-2026-35030 — LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision LiteLLM OIDC userinfo cache uses token:20 as the cache key. Two different JWTs signed with the same algorithm produce identical first 20 characters , allowing an unauthenticated attacker to inherit another user's...

CVE-2026-112363

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112363 Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

EUVD-2026-104403

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112363 Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112363

The Crawl4AI library (versions 0.8.7 through 0.9.5 ) is vulnerable to a Server-Side Request Forgery (SSRF) within the Docker API server . The root cause stems from differences in URL userinfo parsing , allowing unauthenticated attackers to bypass destination checks. By setting fetch_ssl_certifica...

CVE-2026-112363 Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

PT-2026-117471

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch ssl certificate=true with crafted userinfo URLs so...

CVE-2026-112363: Server-Side Request Forgery (SSRF)

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-111691

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111691

The WIMOOR software (through commit ec86736 ) contains an authentication bypass vulnerability caused by the processing of an unsigned X-USERINFO header. Attackers who can reach backend service ports directly—bypassing the gateway—can forge companyid and manager or admin usertype values. This allo...

CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

EUVD-2026-102982

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

PT-2026-116090

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-111691: Authentication Bypass by Spoofing

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or...

CVE-2026-109559

EdgeEver Desktop versions 1.6.26 through 1.112.0 are vulnerable to a navigation allowlist bypass caused by insufficient string-prefix URL matching . Attackers can exploit this by embedding a link using userinfo syntax after the dev-server prefix—for instance, within a note-template preview—to loa...

CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

F5 BIG-IP OAuth UserInfo Heap Overflow (CVE-2026-94127)

Exploits CVE-2026-94127 in F5 BIG-IP APM: crafted oversized Bearer tokens sent to the OAuth UserInfo endpoint trigger a heap buffer overflow when an APM access policy and OAuth Authorization Server profile are configured. !/usr/bin/env python3 -- coding: utf-8 -- """F5 BIG-IP APM OAuth UserInfo...