Jwt Attack
Monthly
JWT signature bypass in Apache Syncope's SRA (Syncope Reverse Application) component enables unauthenticated network attackers to forge arbitrary JWT bearer tokens when the OAuth 2.0 integration is configured without a JWKS set URI, effectively eliminating all cryptographic identity verification for services proxied through SRA. The vulnerability spans three release lines - 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 - and vendor-released fixes are available in 4.0.8 and 4.1.3. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis.
Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. CVSS S:C (scope changed) reflects that driver-level execution escapes application boundaries and achieves OS/kernel-level impact. No public exploit or KEV listing has been identified at time of analysis.
SAML response tampering in HPE IceWall identity and access management products enables a low-privileged attacker to forge authentication assertions and impersonate arbitrary users across federated SSO sessions. The flaw (CWE-347) reflects improper cryptographic signature verification on SAML responses, meaning a tampered assertion can be accepted as legitimate by the IceWall service provider. No public exploit has been identified at time of analysis, but the low attack complexity and fully network-accessible attack surface make this a high-priority remediation for any organization running IceWall-based SSO.
Signature verification bypass in the OCaml jose library (ulrikstrid/ocaml-jose) before 0.11.0 lets attackers forge valid RSA-signed JWS/JWT tokens. The RSA verify path in Jws.ml only confirmed that PKCS #1 decoding succeeded and then returned success, never performing the RSA public-key operation that actually authenticates the signature. Any attacker can craft a token with an arbitrary payload and a syntactically well-formed but cryptographically meaningless signature and have it accepted as valid; no public exploit identified at time of analysis, but the flaw is trivially exploitable once understood.
Authentication bypass in the passport-saml-encrypted Node.js/Passport SAML strategy (versions through 0.1.13) lets a remote attacker impersonate arbitrary users via classic XML Signature Wrapping (XSW). Because signature verification and assertion extraction perform independent, uncorrelated XPath lookups, an attacker who possesses any single validly signed SAML message can prepend a forged, unsigned assertion that the application accepts as the authenticated identity while the genuine signature still validates against the untouched original assertion. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; reported by VulnCheck.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Improper verification of cryptographic signatures in the MQTT command handler of Trueview T18161 S firmware 6.0.23.4 lets a network-positioned attacker replay or tamper with captured MQTT messages — including their nonce, timestamp, and signature fields — and have the device accept and execute the embedded commands. The flaw (CWE-347) yields high
Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.
Token forgery in python-jose through 3.5.0 lets an attacker who possesses the service's asymmetric public key mint valid HS256 (HMAC) JWTs, because the library's HMAC key initialization accepts DER-encoded public keys that lack PEM armor or SSH prefixes and never rejects them as asymmetric material. This is a classic JWT algorithm-confusion (RSA/EC-to-HMAC) attack that succeeds whenever the verifying application does not explicitly restrict the accepted algorithms, and it represents an incomplete fix for CVE-2024-33663. There is no public exploit identified at time of analysis, though the technique is well-documented and the same class of flaw has prior public tooling.
RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to craft signatures that pass verification against arbitrary messages when the verifying party uses low-exponent RSA keys (e=3). The root cause is missing element-count validation inside nested DigestAlgorithm ASN.1 sequences: forge's `_parseAllDigestBytes` mode confirms all bytes are consumed but does not enforce the canonical minimal DigestInfo shape required by RFC 8017, allowing garbage bytes inside the DigestAlgorithm container to survive verification while OpenSSL rejects the same structure. This is explicitly described as an incomplete fix for CVE-2026-33894; a working proof-of-concept is documented in the linked GHSA advisory; no public exploit identified in CISA KEV at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Authentication bypass in oidcc (Erlang/Elixir OpenID Connect library) versions 3.2.0-beta.1 through before 3.9.0 allows unauthenticated attackers to impersonate arbitrary users by presenting a JWE-encrypted ID token or JARM response that wraps unsigned claims, which the library incorrectly accepted as fully validated. The relying party's public encryption key - typically published at a well-known JWKS endpoint - is all an attacker needs to forge tokens with arbitrary sub, iss, and aud values, bypassing provider signing-key possession entirely. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the impact for affected deployments using encrypted ID tokens or JARM is complete authentication bypass.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Privilege escalation in HP OMEN Gaming Hub prior to version 1101.2608.0.0 allows local attackers holding standard user credentials to gain elevated system access by exploiting improper JWT signature verification (CWE-347). The gaming hub service, which operates with elevated OS privileges to manage hardware performance settings on HP OMEN systems, fails to validate cryptographic signatures on JWT tokens used for internal access control, enabling privilege claim forgery. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAML responses and authenticate as any user against the management server without valid credentials. The flaw stems from improper cryptographic signature verification (CWE-347): the management server fails to validate SAML response certificates, so a forged assertion passes unchecked. Exploitation requires either spoofing the IdP's IP address or registering a controlled URL as a trusted IdP endpoint in the management server - conditions that raise the practical bar but, if met, yield full administrative access. No public exploit or CISA KEV listing has been identified; the EPSS score of 0.07% reflects minimal observed exploitation at time of analysis.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Authentication bypass and token replay in node-opcua's UserNameIdentityToken handler enables unauthenticated remote attackers to authenticate as any user whose account accepts an empty password, and to replay captured session tokens unconditionally across unrelated sessions. Versions up to and including 2.165.0 of the npm package are affected. The vulnerability is compounded when SecurityMode=None is configured, which causes the channel-level signature verification to return true unconditionally. A proof-of-concept attack sequence has been dynamically confirmed by the reporter; no vendor-released patch has been identified at time of analysis.
Authentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26, lets a remote unauthenticated attacker gain full administrative access by presenting a forged JWT whose RSA signature is invalid. The flaw lives in the signature-verification logic of jst_functions.c, which accepts tokens without properly validating the RSA signature. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the CVSS 9.8 rating and trivial exploitation path make it a high-priority patch for exposed devices.
Unsigned x-amz-* header injection in Ceph Object Gateway (RGW) SigV4 allows any holder of a presigned URL to attach arbitrary unsigned x-amz-* headers - such as ACL grants, copy-source directives, or storage-class overrides - that RGW silently honors without verifying they were covered by the original cryptographic signature. Affected versions are Ceph prior to 19.2.6 and prior to 20.2.4; the flaw directly enables privilege escalation beyond the permissions the URL signer intended. No public exploit code or active exploitation is confirmed at time of analysis, and vendor-released patches for both stable branches are available.
Multiple cryptographic implementation defects in the libcrux Rust crates - libcrux-ecdh, libcrux-ed25519, and libcrux-psq - expose applications to availability failures and potential key-material weaknesses. libcrux-ecdh omitted length validation and clamping enforcement on X25519 secret inputs (including a broken clamping check for imported keys), libcrux-ed25519 applied a duplicated clamping step during key generation that could silently corrupt key material, and libcrux-psq panicked on AEAD decryption errors instead of returning them to callers. Vendor-released patch versions 0.0.6 (ecdh, ed25519) and 0.0.7 (psq) resolve all three defects; no public exploit code or CISA KEV listing has been identified at time of analysis.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with ciphertext in transit defeat integrity protection, because a failed AES-GCM authenticated decryption in pqc.py silently falls back to unauthenticated AES-CTR. Reported by VulnCheck and carrying a CVSS 4.0 base score of 9.3, the flaw enables undetected bit-flipping and ciphertext manipulation. No public exploit identified at time of analysis, but a vendor patch is available.
Secret disclosure affects the openssl_encrypt Python library (all versions before 1.4.0), where PublicKeyBundle.from_dict() constructs key bundles from untrusted serialized data without validating the embedded self-signature, and to_identity() then promotes that unverified bundle into a usable Identity. An application that deserializes an attacker-supplied bundle and encrypts to it - without an intervening verify_signature() call - will encrypt secrets to an attacker-controlled public key, allowing the attacker to decrypt them. Reported by VulnCheck and fixed in 1.4.0; no public exploit has been identified at time of analysis.
Key-based authorization bypass in @fastify/jwt before 10.2.2 permits any low-privileged authenticated user holding a token signed by the application's global secret to access routes explicitly restricted to a separate per-request key, silently crossing a cryptographic trust boundary. Applications implementing multi-domain JWT authorization - for example, separating user and admin token verification keys - are specifically at risk, as the plugin's option merge incorrectly applies the global key last, overriding the developer-supplied per-request key. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the fix is available in version 10.2.2 and the attack path is mechanically straightforward for any authenticated user.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Signature verification bypass in the PAX Technology Q80 payment terminal's application installer enables network-adjacent unauthenticated attackers to install unsigned or malicious applications, which when chained with a secondary vulnerability results in arbitrary code execution at the root privilege level. The flaw stems from the installer's failure to properly validate cryptographic signatures - tagged as a JWT attack vector - before accepting and executing application packages. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the formal ZDI advisory ZDI-26-526 publicly discloses the vulnerability details.
Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.
Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically crafted forged sumdb tile pairs, exploiting CWE-347 (improper cryptographic verification) in the cmd/go toolchain's tile-parent validation logic. Affected are cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3 - any developer workstation or CI/CD pipeline using these versions and a non-default GOPROXY is at risk of silently caching attacker-controlled module content that cannot be distinguished from legitimate modules through normal transparency log evaluation. No public exploit has been identified and no CISA KEV listing exists; EPSS of 0.12% (3rd percentile) indicates low current exploitation probability, but the theoretical supply chain impact is severe.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status.
JFrog Artifactory's JWT handling allows a holder of a valid integration credential to impersonate arbitrary users under specific conditions, exploiting an improper cryptographic signature verification flaw (CWE-347). Any actor in possession of a legitimate integration token - such as a CI/CD service account - can craft or manipulate JWT tokens to assume the identity of other users, including privileged ones, gaining their full access to repositories and administrative functions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, the full C:H/I:H/A:H CVSS impact profile warrants prompt patching in environments where integration credentials are broadly distributed.
SAML response impersonation in JFrog Artifactory (all tracked versions per CPE) permits an attacker who possesses a valid SAML response to assume the identity of another user under specific conditions. Rooted in CWE-347 (Improper Verification of Cryptographic Signature), the flaw indicates Artifactory fails to adequately validate SAML assertion signatures or cryptographic bindings - a class of weakness commonly exploited via XML Signature Wrapping (XSW) or assertion replay attacks. The 'JWT Attack' tag suggests Artifactory may internally convert SAML assertions to JWT tokens, and the signature verification gap may exist at that translation layer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SAML authentication bypass in PicketLink's Service Provider signature validation allows a network-accessible attacker with low privileges to forge a SAML response and authenticate as any principal with any role on the protected application. The flaw, rooted in CWE-347 (Improper Verification of Cryptographic Signature), arises because the signature check vacuously passes when the SAML response contains zero matching assertion elements, giving the attacker full control over identity and role claims presented to the SP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact on confidentiality and integrity make this a critical authentication control failure.
Authentication bypass in Red Hat PicketLink Federation's SAML implementation lets unauthenticated remote attackers impersonate any principal in any role, because the unsolicited (IdP-initiated) response handler accepts forged SAML assertions without verifying their signature or validating their contents. Successful exploitation yields full identity spoofing, enabling information disclosure and access to restricted operations. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial-to-forge nature make this a high-priority flaw for any application relying on PicketLink SAML SSO.
Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-privileged network attackers to forge or manipulate JWT tokens, bypassing authentication and authorization controls. The vulnerability maps to CWE-347 and is tagged as a JWT attack vector capable of authentication bypass, with high confidentiality and integrity impact confirmed in the vendor's own CVSS 4.0 assessment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a meaningful risk for any organization running affected Pega Infinity deployments.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.
Privilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions by exploiting improper verification of a cryptographic signature (CWE-347), consistent with the vendor-supplied 'Authentication Bypass' and 'JWT Attack' tags. The maximal 9.8 CVSS with a fully network-reachable, no-privilege, no-interaction vector makes this a critical bypass of the admin portal's trust boundary. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Signature validation bypass in Misskey (versions 12.37.0 through prior to 2026.5.4) allows an attacker to have spoofed ActivityPub activities accepted as authentic. The flaw resides in the JSON-LD signature validation and compaction logic (CWE-347), enabling forgery of federated actions such as posts or actions attributed to other actors/instances. The CVSS 4.0 base score is 9.2 (Critical) with a network, unauthenticated, low-complexity vector emphasizing integrity impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to submit arbitrary XML documents that are accepted as cryptographically valid without any digest or key check ever running. The verify() function unconditionally returns true after looping over all dsig:Signature elements, even when every iteration exited early via a skip path before cryptographic validation. No public exploit has been identified beyond the proof-of-concept test case embedded in the fix commit, and this vulnerability is not currently listed in the CISA KEV catalog.
XML Signature Wrapping in Net::SAML2 before 0.86 allows any party holding a single valid IdP-signed assertion to authenticate as an arbitrary user against Perl applications that use this SAML SP library. Identity fields - NameID, attributes, SessionIndex, audience - are extracted via document-wide XPath queries selecting the first matching element in document order, not the element covered by the verified signature; an attacker who prepends an unsigned forged assertion to a Response containing their own legitimate signed assertion bypasses identity verification entirely while the signature check still passes. A vendor-released patch exists in version 0.86, and no public exploit has been identified at time of analysis.
Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate ID attributes, letting attackers forge signed content that still validates. verify() resolves a signed Reference URI with the XPath "//*[@ID='$id']" and trusts the first matching node, so a document containing two elements with the same ID passes verification while a downstream consumer reads the attacker-supplied second element; in a SAML2 SP this puts Assertion contents under attacker control. Rated CVSS 9.1 (network, no authentication, no user interaction); no public exploit identified at time of analysis, though the vendor's fix ships a regression test that reproduces the technique.
Authentication bypass in the Net::SAML2 Perl module before 0.86 lets an unauthenticated attacker log in as any user against Service Providers that accept EncryptedAssertions. The flaw stems from _verify_encrypted_assertion returning a decrypted assertion as 'verified' whenever it contains no dsig:Signature element, skipping both the signature and trust-anchor checks. Because an SP publishes its encryption certificate in SAML metadata, anyone can encrypt a forged unsigned assertion to it, wrap it in a samlp:Response, and post it to the assertion consumer service; no public exploit identified at time of analysis but the logic bug is trivially reproducible.
SAML authentication bypass in Net::SAML2 versions before 0.86 for Perl allows remote unauthenticated attackers to forge arbitrary SAML assertions against service providers that omit a trust anchor during library configuration. The flaw is in verify_xml, which exits early after validating the XML signature against the certificate embedded within the response itself - meaning an attacker who controls the response can supply their own self-signed certificate and sign any assertion they choose. No public exploit is identified at time of analysis, but the vulnerability is mechanically trivial to reproduce given that the vulnerable code path is fully documented in referenced MetaCPAN source files.
RSA PKCS#1 v1.5 signature forgery is possible in Bouncy Castle for Java (bc-java before 1.85, bc-lts-java before 2.73.12) when the DigestInfo encoding omits the NULL AlgorithmIdentifier parameter. The off-by-two bytes in the RSADigestSigner comparison loop allows any forged signature whose DigestInfo matches all bytes except the final two of the message hash to pass verification as valid, achieving a high-integrity bypass. No public exploit has been identified at time of analysis, but the public patch commit includes a step-by-step test demonstrating the exact forgery technique, substantially lowering the bar to exploitation.
Signature bypass in Bouncy Castle for Java allows any attacker-supplied content wrapped in a zero-signer CMS envelope to pass `CMSSignedData.verifySignatures()` without any valid cryptographic signature. The method iterates an empty signerInfos SET, falls through to a vacuous `return true`, and any application using it as its top-level authenticity check silently accepts unsigned attacker-controlled content as authenticated - a classic fail-open flaw (CWE-347). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is trivially constructible using any standard CMS/PKCS#7 library.
OpenPGP inline-signature policy enforcement in Bouncy Castle for Java silently discards rejection exceptions, causing signatures that use prohibited weak hash algorithms (MD5, SHA-1, RIPEMD-160) or otherwise violate the configured OpenPGPPolicy to be reported as cryptographically valid. Affected are bc-java before 1.85 and bcpg-fips (bc-fja) before 2.0.13; the detached-signature and prefixed-signature verification paths are not affected - only the inline one-pass path. A vendor patch is available; no public exploit code has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects a high integrity impact driven by the unauthenticated network vector.
Session revocation denial-of-service in ueberauth Guardian (Elixir) allows an unauthenticated network attacker to forcibly terminate any user's active session by submitting a cryptographically forged JWT to a logout endpoint. Guardian.revoke/3 extracted claims via peek/1 - which only base64-decodes the JWT without verifying the signature - and passed those unverified claims directly to the token store's revocation callback, enabling a forged token carrying a victim's jti or sub values to evict a legitimate session. The vulnerability spans all production releases 1.0.0 through pre-2.4.1; no public exploit or CISA KEV listing exists at time of analysis, but the attack requires only knowledge of a victim's identifying JWT claims.
HMAC-SHA1 URL signature bypass in Thumbor (pip/thumbor ≤ 7.7.7) allows unauthenticated remote attackers to defeat the signed URL security mechanism by injecting duplicate signature strings into the request path. Python's global `str.replace()` removes all occurrences of the signature during pre-validation stripping, causing the validated URL to differ from the actual requested resource. No public exploit code is identified at time of analysis, though the detailed disclosure and fix commit make independent exploitation straightforward; this is not listed in CISA KEV.
Unauthenticated firmware implantation in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers allows a remote attacker to push a modified firmware image to the basemodule because the update routine only checks a CRC32 checksum and performs no cryptographic signature verification (CWE-347). A successful upload yields full system compromise of the controller. No public exploit has been identified at time of analysis, but the flaw is network-reachable with no authentication and a vendor patch (v1.9.1) is available.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.
Privilege escalation in Lenze C430, C520, C550, and i950 series devices allows low-privileged local attackers to bypass SSH enablement signature verification. This enables unauthorized SSH access, leading to complete system compromise. The vulnerability is tracked under CVE-2026-14837 and was reported by CERTVDE; no public exploit or active exploitation (KEV) has been confirmed at this time.
ID Token signature verification bypass in OIDC::Lite Perl library through version 0.12.1 allows unauthenticated remote attackers to forge authentication tokens by controlling the algorithm allowlist used during verification. When a relying party calls the verify method without pinning a specific algorithm, the library extracts the ‘alg’ value from the attacker-controlled token header and passes it as an accepted-algorithm allowlist, enabling ‘alg=none’ (no signature check) or key‑confusion attacks (e.g., RS256 to HS256). An attacker can impersonate any user by crafting a token with arbitrary ‘sub’ claims. No active exploitation has been confirmed, and the EPSS score (0.17%) suggests low immediate threat, but the issue is critical for unpatched systems using the unpinned verification path.
Signature-verification bypass in Network-AI before 5.13.4 lets unauthenticated remote attackers forge APS delegation payloads and mint signed permission-grant tokens for privileged scopes, including SHELL_EXEC. The root cause is a default local verifier in APSAdapter that treats any non-empty string as a valid cryptographic signature, so no real key material or authentication is needed. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivial exploitation logic and network reachability make it a high-priority fix.
Authentication bypass in the Microsoft 365 / Microsoft Entra ID (local_o365) plugin for Moodle allows an unauthenticated attacker to forge a JWT and log in as any Office 365-linked Moodle user before versions 4.5.6, 5.0.5, and 5.1.1. The Teams SSO endpoint sso_login.php base64-decodes the JWT payload and trusts the 'upn' claim without verifying the token signature, so a self-signed or hand-crafted token is accepted as valid. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is trivially exploitable and confirmed by a Microsoft GitHub security advisory (GHSA-hqjh-93qv-47v5).
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.
Authentication bypass via forged JWTs in DataEase, an open-source data visualization and BI tool, allows remote unauthenticated attackers to impersonate any user (including administrators) in enterprise deployments before version 2.10.23. The enterprise TokenFilter passes attacker-supplied X-DE-TOKEN values to a validator that checks only token presence and length, then decodes the JWT without verifying its signature, so tokens with a chosen uid and oid are accepted whenever the enterprise license is valid (licenseValid=true). CVSS 4.0 rates this 9.5 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets a remote, unauthenticated attacker defeat a cryptographic-signature check over the network — most likely a JWT/token signature verification flaw per the vendor 'Jwt Attack' and 'Authentication Bypass' tags. By forging or tampering with signed data the runtime fails to validate correctly, an attacker can impersonate trusted principals and undermine an authentication or integrity control. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.
Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships without cryptographic signature validation (CWE-347), letting an attacker who reaches the update capability push a malicious firmware image and have it executed by the device. Reported by DIVD (advisory DIVD-2026-00001) with a CVSS 4.0 base score of 9.3 and a 'Jwt Attack' angle noted in triage tags, the flaw grants full compromise of the charger. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Signature-verification bypass in YesWiki (v4.6.5 and earlier, ActivityPub-federated Bazar forms) lets an unauthenticated remote attacker forge a valid ActivityPub actor and have Create/Update/Delete activities processed as if properly signed. The flaw stems from HttpSignatureService::verifySignature() using a loose boolean check (!openssl_verify(...)) that treats openssl_verify()'s -1 internal-error return as success. A detailed proof-of-concept exists (publicly available exploit code exists) demonstrating full CRUD on Bazar entries; the issue is not in CISA KEV and no EPSS score was provided.
Signature verification bypass in HAVELSAN Liman MYS (versions before release.Master.1107) lets remote attackers forge the source/authenticity of data - tagged as a JWT attack - enabling identity spoofing and likely authentication bypass. Per CVSS the vector is network-based and unauthenticated (AV:N/PR:N) with high impact to confidentiality and integrity. No public exploit is identified at time of analysis and it is not on CISA KEV.
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) arises from an HMAC signature ambiguity in the Actions Artifacts V4 signed-URL scheme, letting an authenticated low-privilege user reuse a validly signed URL outside its intended repository or task context. An attacker with access to a single Actions task can read private artifacts belonging to other repositories and write upload-state for tasks they do not own, crossing the repository trust boundary (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Firmware signature validation bypass in WatchGuard Fireware OS lets an authenticated administrator upload a tampered firmware image through the backup/restore feature and have it installed despite failing integrity checks. Affecting Fireware OS branches 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2025.6.2, the flaw (CWE-347) enables persistent malicious code on the appliance. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high integrity/confidentiality/availability impact and the appliance's privileged network position make it significant.
Cross-tenant JWT authentication bypass in Centrifugo (v3 through v6) lets an attacker holding a valid token for one allowed issuer/tenant authenticate as a different issuer/tenant when the server uses dynamic JWKS endpoint templates. The flaw stems from the JWKS cache and singleflight lookup being keyed only by the JWT header 'kid', so a key fetched for tenant A is reused to verify a token claiming tenant B whenever both JWKS documents share the same 'kid' and tenant A's key is cached first. Publicly available exploit code exists in the form of a reporter-supplied Go unit-test PoC; there is no evidence of active exploitation, and the CVSS base score is 8.2 (AC:H, PR:L, scope-changed).
Signature verification policy bypass in the sigstore npm package allows attackers to have unauthorized signing certificates accepted despite explicit OID-based restrictions. The documented `certificateOIDs` verify option - used by `sigstore.verify()` and `createVerifier()` to require specific Fulcio/workload-identity extension OIDs - is silently discarded during policy construction, so those extension constraints are never enforced while callers believe they are. Publicly available exploit code exists (a proof-of-concept in the advisory), but there is no evidence of active exploitation; EPSS/KEV not indicated in the source data.
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Red Hat Build of Keycloak 26.6/26.6.4) lets an attacker holding valid client credentials abuse a JWT algorithm-confusion weakness in the JWT Authorization Grant flow to forge client assertions and mint unauthorized access tokens. The forged tokens allow impersonation of any federated user tied to the affected Identity Provider, yielding unauthorized access and potential privilege escalation. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; Red Hat rates it 8.1 (High).
Unauthenticated authentication bypass in OpenAM Community Edition (Open Identity Platform fork) through version 16.0.6 lets a network attacker spoof a RADIUS Access-Accept response and obtain a valid OpenAM session for any RADIUS-mapped username, without knowing the shared secret. The flaw stems from the RADIUS client accepting the first inbound UDP datagram as authoritative while skipping source, identifier, and Response Authenticator checks, making it materially easier to exploit than BlastRADIUS (CVE-2024-3596) since no MD5 chosen-prefix forgery is needed. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in version 16.1.1.
Signature-verification bypass in wolfSSL's OpenSSL compatibility layer allows a degenerate (certs-only) PKCS#7 object - one with empty signerInfos and no actual signature - to be falsely reported as verified by wolfSSL_PKCS7_verify(). Applications using the PKCS7_verify() compat API to authenticate attacker-supplied PKCS#7/CMS bundles can be tricked into treating unsigned content as authentic, undermining integrity guarantees. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the underlying defect is a classic improper-signature-verification (CWE-347) issue with a CVSS 4.0 base score of 8.2.
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar method (reachable via doCryptoHugeFileToFile), letting a high-privileged remote attacker push a forged WAR update and run arbitrary code as SYSTEM. The flaw (CWE-347) was reported by Trend Micro ZDI as ZDI-CAN-28590 and carries a CVSS 3.0 base score of 7.2; no public exploit identified at time of analysis.
Authentication bypass in Rocket.Chat's SAML service provider lets attackers log in as arbitrary users when SAML is enabled but the IdP certificate field is left at its empty shipped default, which causes signature validation to be silently skipped. All versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 are affected, and the CVSS 4.0 base score is 9.3 (Critical). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the fail-open behavior is reachable in a near-default configuration, making it a high-priority fix.
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attackers to forge OIDC identity tokens and obtain fully authenticated technician sessions, because the server accepts ID tokens without verifying their cryptographic signature. Publicly available exploit code exists and the flaw can also bypass MFA in some configurations, making vulnerable remote-support deployments a high-priority target despite no current CISA KEV listing.
TLS hostname verification is silently disabled in Netty's netty-handler module for any client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager), allowing network attackers in a man-in-the-middle position to present a valid certificate for any host and intercept supposedly encrypted traffic. Affects all Netty versions prior to 4.1.135.Final and 4.2.15.Final; no public exploit identified at time of analysis and EPSS is very low (0.04%), but the defect bypasses a core TLS protection that Netty 4.2 explicitly advertises as enabled by default.
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.
JWT signature bypass in Apache Syncope's SRA (Syncope Reverse Application) component enables unauthenticated network attackers to forge arbitrary JWT bearer tokens when the OAuth 2.0 integration is configured without a JWKS set URI, effectively eliminating all cryptographic identity verification for services proxied through SRA. The vulnerability spans three release lines - 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 - and vendor-released fixes are available in 4.0.8 and 4.1.3. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis.
Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. CVSS S:C (scope changed) reflects that driver-level execution escapes application boundaries and achieves OS/kernel-level impact. No public exploit or KEV listing has been identified at time of analysis.
SAML response tampering in HPE IceWall identity and access management products enables a low-privileged attacker to forge authentication assertions and impersonate arbitrary users across federated SSO sessions. The flaw (CWE-347) reflects improper cryptographic signature verification on SAML responses, meaning a tampered assertion can be accepted as legitimate by the IceWall service provider. No public exploit has been identified at time of analysis, but the low attack complexity and fully network-accessible attack surface make this a high-priority remediation for any organization running IceWall-based SSO.
Signature verification bypass in the OCaml jose library (ulrikstrid/ocaml-jose) before 0.11.0 lets attackers forge valid RSA-signed JWS/JWT tokens. The RSA verify path in Jws.ml only confirmed that PKCS #1 decoding succeeded and then returned success, never performing the RSA public-key operation that actually authenticates the signature. Any attacker can craft a token with an arbitrary payload and a syntactically well-formed but cryptographically meaningless signature and have it accepted as valid; no public exploit identified at time of analysis, but the flaw is trivially exploitable once understood.
Authentication bypass in the passport-saml-encrypted Node.js/Passport SAML strategy (versions through 0.1.13) lets a remote attacker impersonate arbitrary users via classic XML Signature Wrapping (XSW). Because signature verification and assertion extraction perform independent, uncorrelated XPath lookups, an attacker who possesses any single validly signed SAML message can prepend a forged, unsigned assertion that the application accepts as the authenticated identity while the genuine signature still validates against the untouched original assertion. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; reported by VulnCheck.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Improper verification of cryptographic signatures in the MQTT command handler of Trueview T18161 S firmware 6.0.23.4 lets a network-positioned attacker replay or tamper with captured MQTT messages — including their nonce, timestamp, and signature fields — and have the device accept and execute the embedded commands. The flaw (CWE-347) yields high
Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.
Token forgery in python-jose through 3.5.0 lets an attacker who possesses the service's asymmetric public key mint valid HS256 (HMAC) JWTs, because the library's HMAC key initialization accepts DER-encoded public keys that lack PEM armor or SSH prefixes and never rejects them as asymmetric material. This is a classic JWT algorithm-confusion (RSA/EC-to-HMAC) attack that succeeds whenever the verifying application does not explicitly restrict the accepted algorithms, and it represents an incomplete fix for CVE-2024-33663. There is no public exploit identified at time of analysis, though the technique is well-documented and the same class of flaw has prior public tooling.
RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to craft signatures that pass verification against arbitrary messages when the verifying party uses low-exponent RSA keys (e=3). The root cause is missing element-count validation inside nested DigestAlgorithm ASN.1 sequences: forge's `_parseAllDigestBytes` mode confirms all bytes are consumed but does not enforce the canonical minimal DigestInfo shape required by RFC 8017, allowing garbage bytes inside the DigestAlgorithm container to survive verification while OpenSSL rejects the same structure. This is explicitly described as an incomplete fix for CVE-2026-33894; a working proof-of-concept is documented in the linked GHSA advisory; no public exploit identified in CISA KEV at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Authentication bypass in oidcc (Erlang/Elixir OpenID Connect library) versions 3.2.0-beta.1 through before 3.9.0 allows unauthenticated attackers to impersonate arbitrary users by presenting a JWE-encrypted ID token or JARM response that wraps unsigned claims, which the library incorrectly accepted as fully validated. The relying party's public encryption key - typically published at a well-known JWKS endpoint - is all an attacker needs to forge tokens with arbitrary sub, iss, and aud values, bypassing provider signing-key possession entirely. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the impact for affected deployments using encrypted ID tokens or JARM is complete authentication bypass.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Privilege escalation in HP OMEN Gaming Hub prior to version 1101.2608.0.0 allows local attackers holding standard user credentials to gain elevated system access by exploiting improper JWT signature verification (CWE-347). The gaming hub service, which operates with elevated OS privileges to manage hardware performance settings on HP OMEN systems, fails to validate cryptographic signatures on JWT tokens used for internal access control, enabling privilege claim forgery. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAML responses and authenticate as any user against the management server without valid credentials. The flaw stems from improper cryptographic signature verification (CWE-347): the management server fails to validate SAML response certificates, so a forged assertion passes unchecked. Exploitation requires either spoofing the IdP's IP address or registering a controlled URL as a trusted IdP endpoint in the management server - conditions that raise the practical bar but, if met, yield full administrative access. No public exploit or CISA KEV listing has been identified; the EPSS score of 0.07% reflects minimal observed exploitation at time of analysis.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Authentication bypass and token replay in node-opcua's UserNameIdentityToken handler enables unauthenticated remote attackers to authenticate as any user whose account accepts an empty password, and to replay captured session tokens unconditionally across unrelated sessions. Versions up to and including 2.165.0 of the npm package are affected. The vulnerability is compounded when SecurityMode=None is configured, which causes the channel-level signature verification to return true unconditionally. A proof-of-concept attack sequence has been dynamically confirmed by the reporter; no vendor-released patch has been identified at time of analysis.
Authentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26, lets a remote unauthenticated attacker gain full administrative access by presenting a forged JWT whose RSA signature is invalid. The flaw lives in the signature-verification logic of jst_functions.c, which accepts tokens without properly validating the RSA signature. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the CVSS 9.8 rating and trivial exploitation path make it a high-priority patch for exposed devices.
Unsigned x-amz-* header injection in Ceph Object Gateway (RGW) SigV4 allows any holder of a presigned URL to attach arbitrary unsigned x-amz-* headers - such as ACL grants, copy-source directives, or storage-class overrides - that RGW silently honors without verifying they were covered by the original cryptographic signature. Affected versions are Ceph prior to 19.2.6 and prior to 20.2.4; the flaw directly enables privilege escalation beyond the permissions the URL signer intended. No public exploit code or active exploitation is confirmed at time of analysis, and vendor-released patches for both stable branches are available.
Multiple cryptographic implementation defects in the libcrux Rust crates - libcrux-ecdh, libcrux-ed25519, and libcrux-psq - expose applications to availability failures and potential key-material weaknesses. libcrux-ecdh omitted length validation and clamping enforcement on X25519 secret inputs (including a broken clamping check for imported keys), libcrux-ed25519 applied a duplicated clamping step during key generation that could silently corrupt key material, and libcrux-psq panicked on AEAD decryption errors instead of returning them to callers. Vendor-released patch versions 0.0.6 (ecdh, ed25519) and 0.0.7 (psq) resolve all three defects; no public exploit code or CISA KEV listing has been identified at time of analysis.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with ciphertext in transit defeat integrity protection, because a failed AES-GCM authenticated decryption in pqc.py silently falls back to unauthenticated AES-CTR. Reported by VulnCheck and carrying a CVSS 4.0 base score of 9.3, the flaw enables undetected bit-flipping and ciphertext manipulation. No public exploit identified at time of analysis, but a vendor patch is available.
Secret disclosure affects the openssl_encrypt Python library (all versions before 1.4.0), where PublicKeyBundle.from_dict() constructs key bundles from untrusted serialized data without validating the embedded self-signature, and to_identity() then promotes that unverified bundle into a usable Identity. An application that deserializes an attacker-supplied bundle and encrypts to it - without an intervening verify_signature() call - will encrypt secrets to an attacker-controlled public key, allowing the attacker to decrypt them. Reported by VulnCheck and fixed in 1.4.0; no public exploit has been identified at time of analysis.
Key-based authorization bypass in @fastify/jwt before 10.2.2 permits any low-privileged authenticated user holding a token signed by the application's global secret to access routes explicitly restricted to a separate per-request key, silently crossing a cryptographic trust boundary. Applications implementing multi-domain JWT authorization - for example, separating user and admin token verification keys - are specifically at risk, as the plugin's option merge incorrectly applies the global key last, overriding the developer-supplied per-request key. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the fix is available in version 10.2.2 and the attack path is mechanically straightforward for any authenticated user.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Signature verification bypass in the PAX Technology Q80 payment terminal's application installer enables network-adjacent unauthenticated attackers to install unsigned or malicious applications, which when chained with a secondary vulnerability results in arbitrary code execution at the root privilege level. The flaw stems from the installer's failure to properly validate cryptographic signatures - tagged as a JWT attack vector - before accepting and executing application packages. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the formal ZDI advisory ZDI-26-526 publicly discloses the vulnerability details.
Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.
Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically crafted forged sumdb tile pairs, exploiting CWE-347 (improper cryptographic verification) in the cmd/go toolchain's tile-parent validation logic. Affected are cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3 - any developer workstation or CI/CD pipeline using these versions and a non-default GOPROXY is at risk of silently caching attacker-controlled module content that cannot be distinguished from legitimate modules through normal transparency log evaluation. No public exploit has been identified and no CISA KEV listing exists; EPSS of 0.12% (3rd percentile) indicates low current exploitation probability, but the theoretical supply chain impact is severe.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status.
JFrog Artifactory's JWT handling allows a holder of a valid integration credential to impersonate arbitrary users under specific conditions, exploiting an improper cryptographic signature verification flaw (CWE-347). Any actor in possession of a legitimate integration token - such as a CI/CD service account - can craft or manipulate JWT tokens to assume the identity of other users, including privileged ones, gaining their full access to repositories and administrative functions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, the full C:H/I:H/A:H CVSS impact profile warrants prompt patching in environments where integration credentials are broadly distributed.
SAML response impersonation in JFrog Artifactory (all tracked versions per CPE) permits an attacker who possesses a valid SAML response to assume the identity of another user under specific conditions. Rooted in CWE-347 (Improper Verification of Cryptographic Signature), the flaw indicates Artifactory fails to adequately validate SAML assertion signatures or cryptographic bindings - a class of weakness commonly exploited via XML Signature Wrapping (XSW) or assertion replay attacks. The 'JWT Attack' tag suggests Artifactory may internally convert SAML assertions to JWT tokens, and the signature verification gap may exist at that translation layer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SAML authentication bypass in PicketLink's Service Provider signature validation allows a network-accessible attacker with low privileges to forge a SAML response and authenticate as any principal with any role on the protected application. The flaw, rooted in CWE-347 (Improper Verification of Cryptographic Signature), arises because the signature check vacuously passes when the SAML response contains zero matching assertion elements, giving the attacker full control over identity and role claims presented to the SP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact on confidentiality and integrity make this a critical authentication control failure.
Authentication bypass in Red Hat PicketLink Federation's SAML implementation lets unauthenticated remote attackers impersonate any principal in any role, because the unsolicited (IdP-initiated) response handler accepts forged SAML assertions without verifying their signature or validating their contents. Successful exploitation yields full identity spoofing, enabling information disclosure and access to restricted operations. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial-to-forge nature make this a high-priority flaw for any application relying on PicketLink SAML SSO.
Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-privileged network attackers to forge or manipulate JWT tokens, bypassing authentication and authorization controls. The vulnerability maps to CWE-347 and is tagged as a JWT attack vector capable of authentication bypass, with high confidentiality and integrity impact confirmed in the vendor's own CVSS 4.0 assessment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a meaningful risk for any organization running affected Pega Infinity deployments.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.
Privilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions by exploiting improper verification of a cryptographic signature (CWE-347), consistent with the vendor-supplied 'Authentication Bypass' and 'JWT Attack' tags. The maximal 9.8 CVSS with a fully network-reachable, no-privilege, no-interaction vector makes this a critical bypass of the admin portal's trust boundary. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV, but the 9.1 CVSS and pre-authentication admin impersonation make it a high-priority patch.
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge SAML responses to hijack accounts when a SAML identity-provider's metadata was imported without explicit key-usage attributes, causing the keycloak-services identity-brokering engine to silently disable signature validation despite a signing certificate being present. Rated CVSS 9.1 with total technical impact per CISA SSVC, an attacker who knows a victim's external identifier can log in as that user. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating the risk is currently theoretical/targeted rather than mass-exploited.
Signature validation bypass in Misskey (versions 12.37.0 through prior to 2026.5.4) allows an attacker to have spoofed ActivityPub activities accepted as authentic. The flaw resides in the JSON-LD signature validation and compaction logic (CWE-347), enabling forgery of federated actions such as posts or actions attributed to other actors/instances. The CVSS 4.0 base score is 9.2 (Critical) with a network, unauthenticated, low-complexity vector emphasizing integrity impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to submit arbitrary XML documents that are accepted as cryptographically valid without any digest or key check ever running. The verify() function unconditionally returns true after looping over all dsig:Signature elements, even when every iteration exited early via a skip path before cryptographic validation. No public exploit has been identified beyond the proof-of-concept test case embedded in the fix commit, and this vulnerability is not currently listed in the CISA KEV catalog.
XML Signature Wrapping in Net::SAML2 before 0.86 allows any party holding a single valid IdP-signed assertion to authenticate as an arbitrary user against Perl applications that use this SAML SP library. Identity fields - NameID, attributes, SessionIndex, audience - are extracted via document-wide XPath queries selecting the first matching element in document order, not the element covered by the verified signature; an attacker who prepends an unsigned forged assertion to a Response containing their own legitimate signed assertion bypasses identity verification entirely while the signature check still passes. A vendor-released patch exists in version 0.86, and no public exploit has been identified at time of analysis.
Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate ID attributes, letting attackers forge signed content that still validates. verify() resolves a signed Reference URI with the XPath "//*[@ID='$id']" and trusts the first matching node, so a document containing two elements with the same ID passes verification while a downstream consumer reads the attacker-supplied second element; in a SAML2 SP this puts Assertion contents under attacker control. Rated CVSS 9.1 (network, no authentication, no user interaction); no public exploit identified at time of analysis, though the vendor's fix ships a regression test that reproduces the technique.
Authentication bypass in the Net::SAML2 Perl module before 0.86 lets an unauthenticated attacker log in as any user against Service Providers that accept EncryptedAssertions. The flaw stems from _verify_encrypted_assertion returning a decrypted assertion as 'verified' whenever it contains no dsig:Signature element, skipping both the signature and trust-anchor checks. Because an SP publishes its encryption certificate in SAML metadata, anyone can encrypt a forged unsigned assertion to it, wrap it in a samlp:Response, and post it to the assertion consumer service; no public exploit identified at time of analysis but the logic bug is trivially reproducible.
SAML authentication bypass in Net::SAML2 versions before 0.86 for Perl allows remote unauthenticated attackers to forge arbitrary SAML assertions against service providers that omit a trust anchor during library configuration. The flaw is in verify_xml, which exits early after validating the XML signature against the certificate embedded within the response itself - meaning an attacker who controls the response can supply their own self-signed certificate and sign any assertion they choose. No public exploit is identified at time of analysis, but the vulnerability is mechanically trivial to reproduce given that the vulnerable code path is fully documented in referenced MetaCPAN source files.
RSA PKCS#1 v1.5 signature forgery is possible in Bouncy Castle for Java (bc-java before 1.85, bc-lts-java before 2.73.12) when the DigestInfo encoding omits the NULL AlgorithmIdentifier parameter. The off-by-two bytes in the RSADigestSigner comparison loop allows any forged signature whose DigestInfo matches all bytes except the final two of the message hash to pass verification as valid, achieving a high-integrity bypass. No public exploit has been identified at time of analysis, but the public patch commit includes a step-by-step test demonstrating the exact forgery technique, substantially lowering the bar to exploitation.
Signature bypass in Bouncy Castle for Java allows any attacker-supplied content wrapped in a zero-signer CMS envelope to pass `CMSSignedData.verifySignatures()` without any valid cryptographic signature. The method iterates an empty signerInfos SET, falls through to a vacuous `return true`, and any application using it as its top-level authenticity check silently accepts unsigned attacker-controlled content as authenticated - a classic fail-open flaw (CWE-347). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack primitive is trivially constructible using any standard CMS/PKCS#7 library.
OpenPGP inline-signature policy enforcement in Bouncy Castle for Java silently discards rejection exceptions, causing signatures that use prohibited weak hash algorithms (MD5, SHA-1, RIPEMD-160) or otherwise violate the configured OpenPGPPolicy to be reported as cryptographically valid. Affected are bc-java before 1.85 and bcpg-fips (bc-fja) before 2.0.13; the detached-signature and prefixed-signature verification paths are not affected - only the inline one-pass path. A vendor patch is available; no public exploit code has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects a high integrity impact driven by the unauthenticated network vector.
Session revocation denial-of-service in ueberauth Guardian (Elixir) allows an unauthenticated network attacker to forcibly terminate any user's active session by submitting a cryptographically forged JWT to a logout endpoint. Guardian.revoke/3 extracted claims via peek/1 - which only base64-decodes the JWT without verifying the signature - and passed those unverified claims directly to the token store's revocation callback, enabling a forged token carrying a victim's jti or sub values to evict a legitimate session. The vulnerability spans all production releases 1.0.0 through pre-2.4.1; no public exploit or CISA KEV listing exists at time of analysis, but the attack requires only knowledge of a victim's identifying JWT claims.
HMAC-SHA1 URL signature bypass in Thumbor (pip/thumbor ≤ 7.7.7) allows unauthenticated remote attackers to defeat the signed URL security mechanism by injecting duplicate signature strings into the request path. Python's global `str.replace()` removes all occurrences of the signature during pre-validation stripping, causing the validated URL to differ from the actual requested resource. No public exploit code is identified at time of analysis, though the detailed disclosure and fix commit make independent exploitation straightforward; this is not listed in CISA KEV.
Unauthenticated firmware implantation in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers allows a remote attacker to push a modified firmware image to the basemodule because the update routine only checks a CRC32 checksum and performs no cryptographic signature verification (CWE-347). A successful upload yields full system compromise of the controller. No public exploit has been identified at time of analysis, but the flaw is network-reachable with no authentication and a vendor patch (v1.9.1) is available.
Authentication bypass in Apache Airflow FAB provider allows unauthenticated attackers to log in as any user (including Admin) by sending a forged Azure AD ID token to the OAuth callback endpoint. This affects default deployments of the FAB auth manager with Azure AD OAuth login enabled, prior to version 3.7.3. The vulnerability stems from `verify_signature` defaulting to `False`, enabling acceptance of unsigned or algorithm-none tokens.
Privilege escalation in JFrog Artifactory allows low-privileged authenticated users to forge administrator JWTs by exploiting missing signature validation on refresh tokens. An attacker with any user account can gain full admin control, rated CVSS 8.8. No active exploitation or public exploit is confirmed at this time.
Privilege escalation in Lenze C430, C520, C550, and i950 series devices allows low-privileged local attackers to bypass SSH enablement signature verification. This enables unauthorized SSH access, leading to complete system compromise. The vulnerability is tracked under CVE-2026-14837 and was reported by CERTVDE; no public exploit or active exploitation (KEV) has been confirmed at this time.
ID Token signature verification bypass in OIDC::Lite Perl library through version 0.12.1 allows unauthenticated remote attackers to forge authentication tokens by controlling the algorithm allowlist used during verification. When a relying party calls the verify method without pinning a specific algorithm, the library extracts the ‘alg’ value from the attacker-controlled token header and passes it as an accepted-algorithm allowlist, enabling ‘alg=none’ (no signature check) or key‑confusion attacks (e.g., RS256 to HS256). An attacker can impersonate any user by crafting a token with arbitrary ‘sub’ claims. No active exploitation has been confirmed, and the EPSS score (0.17%) suggests low immediate threat, but the issue is critical for unpatched systems using the unpinned verification path.
Signature-verification bypass in Network-AI before 5.13.4 lets unauthenticated remote attackers forge APS delegation payloads and mint signed permission-grant tokens for privileged scopes, including SHELL_EXEC. The root cause is a default local verifier in APSAdapter that treats any non-empty string as a valid cryptographic signature, so no real key material or authentication is needed. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the trivial exploitation logic and network reachability make it a high-priority fix.
Authentication bypass in the Microsoft 365 / Microsoft Entra ID (local_o365) plugin for Moodle allows an unauthenticated attacker to forge a JWT and log in as any Office 365-linked Moodle user before versions 4.5.6, 5.0.5, and 5.1.1. The Teams SSO endpoint sso_login.php base64-decodes the JWT payload and trusts the 'upn' claim without verifying the token signature, so a self-signed or hand-crafted token is accepted as valid. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is trivially exploitable and confirmed by a Microsoft GitHub security advisory (GHSA-hqjh-93qv-47v5).
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.
Authentication bypass via forged JWTs in DataEase, an open-source data visualization and BI tool, allows remote unauthenticated attackers to impersonate any user (including administrators) in enterprise deployments before version 2.10.23. The enterprise TokenFilter passes attacker-supplied X-DE-TOKEN values to a validator that checks only token presence and length, then decodes the JWT without verifying its signature, so tokens with a chosen uid and oid are accepted whenever the enterprise license is valid (licenseValid=true). CVSS 4.0 rates this 9.5 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets a remote, unauthenticated attacker defeat a cryptographic-signature check over the network — most likely a JWT/token signature verification flaw per the vendor 'Jwt Attack' and 'Authentication Bypass' tags. By forging or tampering with signed data the runtime fails to validate correctly, an attacker can impersonate trusted principals and undermine an authentication or integrity control. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.
Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships without cryptographic signature validation (CWE-347), letting an attacker who reaches the update capability push a malicious firmware image and have it executed by the device. Reported by DIVD (advisory DIVD-2026-00001) with a CVSS 4.0 base score of 9.3 and a 'Jwt Attack' angle noted in triage tags, the flaw grants full compromise of the charger. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Signature-verification bypass in YesWiki (v4.6.5 and earlier, ActivityPub-federated Bazar forms) lets an unauthenticated remote attacker forge a valid ActivityPub actor and have Create/Update/Delete activities processed as if properly signed. The flaw stems from HttpSignatureService::verifySignature() using a loose boolean check (!openssl_verify(...)) that treats openssl_verify()'s -1 internal-error return as success. A detailed proof-of-concept exists (publicly available exploit code exists) demonstrating full CRUD on Bazar entries; the issue is not in CISA KEV and no EPSS score was provided.
Signature verification bypass in HAVELSAN Liman MYS (versions before release.Master.1107) lets remote attackers forge the source/authenticity of data - tagged as a JWT attack - enabling identity spoofing and likely authentication bypass. Per CVSS the vector is network-based and unauthenticated (AV:N/PR:N) with high impact to confidentiality and integrity. No public exploit is identified at time of analysis and it is not on CISA KEV.
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) arises from an HMAC signature ambiguity in the Actions Artifacts V4 signed-URL scheme, letting an authenticated low-privilege user reuse a validly signed URL outside its intended repository or task context. An attacker with access to a single Actions task can read private artifacts belonging to other repositories and write upload-state for tasks they do not own, crossing the repository trust boundary (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Firmware signature validation bypass in WatchGuard Fireware OS lets an authenticated administrator upload a tampered firmware image through the backup/restore feature and have it installed despite failing integrity checks. Affecting Fireware OS branches 11.0 through 11.12.4_Update1, 12.0 through 12.12, and 2025.1 through 2025.6.2, the flaw (CWE-347) enables persistent malicious code on the appliance. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high integrity/confidentiality/availability impact and the appliance's privileged network position make it significant.
Cross-tenant JWT authentication bypass in Centrifugo (v3 through v6) lets an attacker holding a valid token for one allowed issuer/tenant authenticate as a different issuer/tenant when the server uses dynamic JWKS endpoint templates. The flaw stems from the JWKS cache and singleflight lookup being keyed only by the JWT header 'kid', so a key fetched for tenant A is reused to verify a token claiming tenant B whenever both JWKS documents share the same 'kid' and tenant A's key is cached first. Publicly available exploit code exists in the form of a reporter-supplied Go unit-test PoC; there is no evidence of active exploitation, and the CVSS base score is 8.2 (AC:H, PR:L, scope-changed).
Signature verification policy bypass in the sigstore npm package allows attackers to have unauthorized signing certificates accepted despite explicit OID-based restrictions. The documented `certificateOIDs` verify option - used by `sigstore.verify()` and `createVerifier()` to require specific Fulcio/workload-identity extension OIDs - is silently discarded during policy construction, so those extension constraints are never enforced while callers believe they are. Publicly available exploit code exists (a proof-of-concept in the advisory), but there is no evidence of active exploitation; EPSS/KEV not indicated in the source data.
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Red Hat Build of Keycloak 26.6/26.6.4) lets an attacker holding valid client credentials abuse a JWT algorithm-confusion weakness in the JWT Authorization Grant flow to forge client assertions and mint unauthorized access tokens. The forged tokens allow impersonation of any federated user tied to the affected Identity Provider, yielding unauthorized access and potential privilege escalation. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; Red Hat rates it 8.1 (High).
Unauthenticated authentication bypass in OpenAM Community Edition (Open Identity Platform fork) through version 16.0.6 lets a network attacker spoof a RADIUS Access-Accept response and obtain a valid OpenAM session for any RADIUS-mapped username, without knowing the shared secret. The flaw stems from the RADIUS client accepting the first inbound UDP datagram as authoritative while skipping source, identifier, and Response Authenticator checks, making it materially easier to exploit than BlastRADIUS (CVE-2024-3596) since no MD5 chosen-prefix forgery is needed. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in version 16.1.1.
Signature-verification bypass in wolfSSL's OpenSSL compatibility layer allows a degenerate (certs-only) PKCS#7 object - one with empty signerInfos and no actual signature - to be falsely reported as verified by wolfSSL_PKCS7_verify(). Applications using the PKCS7_verify() compat API to authenticate attacker-supplied PKCS#7/CMS bundles can be tricked into treating unsigned content as authentic, undermining integrity guarantees. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the underlying defect is a classic improper-signature-verification (CWE-347) issue with a CVSS 4.0 base score of 8.2.
Authenticated remote code execution in ATEN Unizon stems from a broken cryptographic signature check in the updateWar method (reachable via doCryptoHugeFileToFile), letting a high-privileged remote attacker push a forged WAR update and run arbitrary code as SYSTEM. The flaw (CWE-347) was reported by Trend Micro ZDI as ZDI-CAN-28590 and carries a CVSS 3.0 base score of 7.2; no public exploit identified at time of analysis.
Authentication bypass in Rocket.Chat's SAML service provider lets attackers log in as arbitrary users when SAML is enabled but the IdP certificate field is left at its empty shipped default, which causes signature validation to be silently skipped. All versions prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11 are affected, and the CVSS 4.0 base score is 9.3 (Critical). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the fail-open behavior is reachable in a near-default configuration, making it a high-priority fix.
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attackers to forge OIDC identity tokens and obtain fully authenticated technician sessions, because the server accepts ID tokens without verifying their cryptographic signature. Publicly available exploit code exists and the flaw can also bypass MFA in some configurations, making vulnerable remote-support deployments a high-priority target despite no current CISA KEV listing.
TLS hostname verification is silently disabled in Netty's netty-handler module for any client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager), allowing network attackers in a man-in-the-middle position to present a valid certificate for any host and intercept supposedly encrypted traffic. Affects all Netty versions prior to 4.1.135.Final and 4.2.15.Final; no public exploit identified at time of analysis and EPSS is very low (0.04%), but the defect bypasses a core TLS protection that Netty 4.2 explicitly advertises as enabled by default.
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.