kl-security-key

KL Security Key 由 Karaaslan Labs 开发的实验性开源 RP2040 FIDO2/WebAuthn 认证器工程与互操作性项目。 状态： 工程/研究项目。未获得 FIDO 联盟认证。 并非商业高保障安全令牌。 KL Security Key 是 polhenarejos/pico-fido 的精选衍生项目。它探索在保持身份、认证、验证证据和信任边界明确的前提下，低成本 RP2040 开发板作为物理 WebAuthn 认证器能够达到的程度。 概览 领域| 当前工程参考 ---|--- 硬件| RP2040 USB 开发板 传输| USB FIDO HID...

kanidm

Kanidm - 简单且安全的身份管理 关于 Kanidm 是一个简单且安全的身份管理平台，允许其他应用和服务将身份认证与存储的挑战交由 Kanidm 处理。 该项目的目标是成为一个完整的身份提供方，覆盖尽可能广泛的需求和集成。使用 Kanidm 时，您不需要任何其他组件（如 Keycloak）——我们已经拥有您需要的一切！ 为了实现这一目标，我们高度依赖严格的默认设置、简单的配置和自我修复组件。这使得 Kanidm 能够支持小型家庭实验室、家庭、小型企业，直至大型企业的需求。 如果您想自行托管认证服务，那么 Kanidm 正适合您！ 支持的功能 Kanidm 支持：...

ephemera

Ephemera : ゼロトラスト SSH 認証局 Ephemera は、インフラストラクチャへのゼロトラストアクセスを強制するために設計された、軽量でセルフホストの SSH 認証局です。静的 SSH キーを短命な証明書に置き換え、ハードウェアバックアップされた WebAuthn MFA を統合し、暗号検証可能な監査証跡を維持します。 !NOTE 正規のソース : Codeberg GitHub ミラー : GitHub 可用性とホスティングのため 高レベルアーキテクチャ graph LR subgraph Client"User Operator" SSH"SSH Client"...

Shwmae

Shwmae Shwmae（シュー・マイ）は、DEF CON 32 で「Abusing Windows Hello Without a Severed Hand」というトークの一環として公開された Windows Hello 悪用ツールです。このツールの目的は、特権ユーザーコンテキストから Windows Hello を悪用することです。 Shwmae Copyright C 2024 Shwmae enum Default Verb Enumerate Windows Hello protectors, keys and credentials sign Sign data using...

CVE-2022-28281

CVE-2022-28281: 予期しない WebAuthN 拡張による Mozilla Firefox の範囲外書き込み これは、侵害された Windows Firefox レンダラープロセスからトリガーされる可能性のあるバグです。侵害されたコンテンツプロセスが、親プロセスに Register コマンドで予期しない数の WebAuthN 拡張を送信した場合、範囲外書き込みが発生し、メモリ破損と潜在的に悪用可能なクラッシュにつながります。 CVE-2022-28281 が割り当てられ、Firefox 99 で修正され、mfsa2022-13 に文書化されています。 根本原因分析...

CVE-2026-73313

CVE-2026-73313: Passkey credential not bound to login account XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user. What happens The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies...

CVE-2025-26788

CVE-2025-26788 環境構築 ステップ1 - Docker Desktopの実行確認 docker version ステップ2 - イメージのビルド cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . ステップ3 - コンテナの実行 docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787115646)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787115646 advisory. - Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143...

CVE-2026-79762

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-79762 Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-79762 Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-79762 Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

EUVD-2026-86162

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

CVE-2026-79762

The Termix web-based server management platform (versions 1.7.0 to 2.5.1 ) is vulnerable to credential decryption due to hardcoded default keys. In src/backend/utils/user-crypto.ts, the system derives wrapping keys for OIDC and WebAuthn users' Data Encryption Keys (DEKs) from committed default st...

CVE-2026-79762: Use of Hard-coded Cryptographic Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in...

authelia v4.39.28

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

CVE-2026-80218 Sign-in token minted for one resource accepted by another in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a sign-in token for one authenticated resource to be signed in as a user of a different resource. AshAuthentication.Strategy.Password.SignInWithTokenPreparation.extractprimarykeysfromsubject/2 parse...