58 matches found
cve-2026-20896-gitea-poc
CVE-2026-20896 Gitea Docker 认证绕过检测器 仅限授权的红队/渗透测试操作。 本仓库包含 CVE-2026-20896 的极简检测器，该漏洞是官方 Gitea Docker 镜像在启用反向代理认证时存在的认证绕过漏洞，影响版本直至并包括 1.26.2。 CVE-2026-20896 是什么 受影响的 Gitea Docker 镜像附带了一个包含以下内容的 app.ini 模板： root@kitploit: REVERSEPROXYTRUSTEDPROXIES = 当管理员启用： root@kitploit:...
CVE-2026-20896
CVE-2026-20896: PoC de omisión de autenticación en la imagen Docker de Gitea !WARNING Usa este PoC solo en un laboratorio local o contra un sistema que estés autorizado explícitamente a probar. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Resumen CVE-2026-20896 ...
Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass
The official Gitea Docker image through version 1.26.2 ships with REVERSEPROXYTRUSTEDPROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers X-WEBAUTH-USER from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy...
CVE-2026-20896
CVE-2026-20896 Gitea 的官方 Docker 镜像（最高至 1.26.2 及包括该版本）在其默认配置中包含了 REVERSEPROXYTRUSTEDPROXIES = 。如果你开启了反向代理登录，这个通配符意味着每个来源 IP 都被视为可信代理，因此任何能访问该端口的人都可以发送 X-WEBAUTH-USER 头部并以任意用户身份登录。无需密码，无需令牌。 我已将此问题报告给 Gitea，并在 1.26.3 / 1.26.4 中修复。本仓库是我自己的分析报告、一个可用的 PoC 以及一个检测工具。这是一个已修补的公开漏洞。 CVE...
Exploit for CVE-2026-20896
CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC...
Exploit for CVE-2026-20896
CVE-2026-20896 - Gitea ≤1.26.2 Authentication Bypass 1. What...
SUSE CVE-2026-20896
Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...
Exploit for CVE-2026-20896
CVE-2026-20896 Gitea Docker Auth Bypass Checker Authorized re...
Exploit for CVE-2026-20896
CVE-2026-20896 Gitea's official Docker image up to and inclu...
CVE-2026-20896 Gitea Docker image trusts spoofable reverse-proxy headers by default
Gitea Docker image versions up to and including 1.26.2 use REVERSEPROXYTRUSTEDPROXIES= by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled...
PT-2026-51429
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description When ENABLE REVERSE PROXY AUTHENTICATION is enabled, Gogs accepts the configured authentication header default: X-WEBAUTH-USER directly from client requests without validating that the request originat...
CVE-2026-36817
CVE-2026-36817 affects Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10. The issue is a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function, which can be triggered by a crafted HTTP request to cause a Denial of Service (DoS). The CVSS v3.1 vector...
CVE-2026-41070
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on SSO auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode shared library loaded by OpenVPN via the plugin...
openvpn-auth-oauth2 授权问题漏洞
OpenVPN-Auth-OAuth2 is a single-signpoint login authentication integration tool developed by Jan-Otto Kröpke. In versions 1.26.3 to 1.27.3 of OpenVPN-Auth-OAuth2, there were authorization-related vulnerabilities. These vulnerabilities occurred when clients did not support WebAuth/SSO in...
PT-2026-34452
Name of the Vulnerable Software and Affected Versions openvpn-auth-oauth2 versions 1.26.3 through 1.27.2 Description An authentication bypass exists when the software is deployed in experimental plugin mode. Clients that do not support WebAuth/SSO are incorrectly granted full network access witho...
PT-2026-34525
Summary When openvpn-auth-oauth2 is deployed in the experimental plugin mode shared library loaded by OpenVPN via the plugin directive, clients that do not support WebAuth/SSO e.g., the openvpn CLI on Linux are incorrectly admitted to the VPN despite being denied by the authentication logic. The...
📄 Juniper JunOS 23.4 Module Scanner / Exploitation Framework
This PHP script is a modular scanner and exploitation framework targeting Juniper JunOS CVE‑2023‑36846, an arbitrary file upload vulnerability due to missing authentication.. It is designed with a clear separation of responsibilities and supports single‑target testing, interactive exploitation, a...
EUVD-2013-2076
Malware in sbrugna...