EUVD-2026-81414Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Attacker must hold a valid issued-but-logged-out token (PR:L) and craft a noncanonical encoding (AC:H); no victim interaction is actually required (UI:N); impact limited to continued access within the original token's scope (C:L/I:L).
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
Lifecycle Timeline
1DescriptionCVE.org
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.
AnalysisAI
Logout revocation bypass in SUSE NeuVector lets an authenticated holder of a valid, unexpired NeuVector JWT keep using that token after logout by re-encoding the RSA signature field with a noncanonical-but-equivalent Base64URL spelling, which no longer matches the exact-string logout/revocation blocklist while still passing signature verification. The issue is remotely reachable (AV:N) but requires a previously issued token (PR:L) and non-trivial crafting of an equivalent encoding (AC:H), and the exposure window is strictly bounded by the original token's remaining validity and its original scope, with only partial confidentiality and integrity impact and no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess a valid, cryptographically-signed NeuVector JWT that (1) has not yet reached its expiry time and (2) has been explicitly logged out, so that it sits on the revocation/logout blocklist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-real-risk issue despite being a genuine authorization flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Check the upstream NeuVector security advisory GHSA-wcx5-mq6c-c54j (https://github.com/neuvector/neuvector/security/advisories/GHSA-wcx5-mq6c-c54j) and SUSE Bugzilla entry CVE-2026-78426 (https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78426) for the fixed release, and upgrade to that vendor-released version, redeploying updated NeuVector controller, enforcer, and manager images; no vendor-released patch version was identified in the data provided for this analysis, so confirmation of a fixed build should be obtained directly from the vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's f
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today