Skip to main content

CWE-1270

Generation of Incorrect Security Tokens

7 CVEs Avg CVSS 7.1 MITRE
2
CRITICAL
1
HIGH
4
MEDIUM
0
LOW
1
POC
0
KEV

Monthly

CVE-2026-19636 MEDIUM PATCH This Month

Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.

CSRF Security Center
NVD
CVSS 4.0
6.0
EPSS
0.3%
CVE-2026-15831 MEDIUM PATCH This Month

Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.

Gitlab Authentication Bypass
NVD
CVSS 3.1
4.3
EPSS
0.2%
CVE-2026-49499 HIGH PATCH This Week

Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.

Information Disclosure Dell Powerprotect Data Manager
NVD
CVSS 3.1
8.8
EPSS
0.4%
CVE-2025-59698 MEDIUM POC This Month

CVE-2025-59698 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.

Information Disclosure Nshield 5c Firmware Nshield Connect Xc Mid Firmware Nshield Connect Xc Base Firmware Nshield Connect Xc High Firmware +1
NVD GitHub VulDB
CVSS 3.1
6.8
EPSS
0.0%
CVE-2023-22644 Go CRITICAL PATCH Act Now

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Manager Server
NVD GitHub
CVSS 4.0
9.4
EPSS
0.5%
CVE-2023-2882 CRITICAL Act Now

Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.0.3.4 Panel: v4.0.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Cbot Core Cbot Panel
NVD
CVSS 3.1
9.8
EPSS
0.1%
CVE-2023-30524 Maven MEDIUM This Month

Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Jenkins Information Disclosure Report Portal
NVD
CVSS 3.1
4.3
EPSS
0.4%
EPSS 0% CVSS 6.0
MEDIUM PATCH This Month

Predictable CSRF token generation in Tenable Security Center allows a network-accessible attacker to forge authenticated requests on behalf of a victim user, resulting in high-integrity impact with no confidentiality or availability loss. The CWE-1270 root cause - generation of incorrect security tokens - means the anti-CSRF control was structurally weakened by insufficient entropy, not absent; attackers who can observe or predict token patterns can bypass it. No public exploit code or CISA KEV listing has been identified at time of analysis; Tenable has released a fix documented in advisory TNS-2026-22.

CSRF Security Center
NVD
EPSS 0% CVSS 4.3
MEDIUM PATCH This Month

Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.

Gitlab Authentication Bypass
NVD
EPSS 0% CVSS 8.8
HIGH PATCH This Week

Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.

Information Disclosure Dell Powerprotect Data Manager
NVD
EPSS 0% CVSS 6.8
MEDIUM POC This Month

CVE-2025-59698 is a security vulnerability (CVSS 6.8) that allows a physically proximate attacker. Risk factors: public PoC available.

Information Disclosure Nshield 5c Firmware Nshield Connect Xc Mid Firmware +3
NVD GitHub VulDB
EPSS 0% CVSS 9.4
CRITICAL PATCH Act Now

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Manager Server
NVD GitHub
EPSS 0% CVSS 9.8
CRITICAL Act Now

Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.0.3.4 Panel: v4.0.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure Cbot Core Cbot Panel
NVD
EPSS 0% CVSS 4.3
MEDIUM This Month

Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Jenkins Information Disclosure Report Portal
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy