Jwt Attack
Monthly
A signature-verification bypass in the update-installation functionality of Nozomi Networks Guardian and CMC before 26.4.0 allows an attacker who already holds administrative privileges on the appliance to supply a crafted update bundle that passes signature checks while carrying an unsigned script, which then executes with root privileges at install time. Successful exploitation gives full read and write access to sensitive data, the ability to alter appliance configuration, or to shut the appliance down (CWE-347, CVSS 4.0 7.5 with PR:H and AT:P; independent assessment scores it CVSS 3.1 7.5 with C:H/I:H/A:H). The prerequisite is significant - administrative authentication and access to the update-installation path are mandatory, and no unauthenticated route is described - and no public exploit has been identified at time of analysis, though the vendor fix in 26.4.0 should be applied this week per the current priority decision.
Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis.
Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present.
Unauthenticated role forgery in Apache Pulsar lets a client present a forged or unsigned JSON Web Token listing arbitrary roles and have those roles honored when the broker uses MultiRolesTokenAuthorizationProvider alongside a non-empty anonymousUserRole. The flaw is reachable over the broker's HTTP surfaces, including the admin REST API and the WebSocket API, where failed credentials can fall back to the anonymous role while the original Authorization header is retained and later trusted without signature verification; an attacker who names a role configured in superUserRoles can obtain super-user access to tenants, namespaces, topics, permissions and broker configuration. Only deployments combining MultiRolesTokenAuthorizationProvider with a non-empty anonymousUserRole and the fallback conditions are exposed, while installations using the default PulsarAuthorizationProvider, another authorization provider, or an unset anonymousUserRole are unaffected. Vendor-released patch: 4.0.14 and 4.2.5; no public exploit identified at time of analysis, and exploitation also requires the specific non-default configuration described.
Unsigned firmware images are accepted and flashed by the boa-based firmware update handler on TOTOLINK X2000R routers running build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, allowing an attacker who already holds administrative web-interface credentials to install arbitrary firmware. The flaw is an improper verification of cryptographic signature (CWE-347): the device performs no meaningful code-signing check on the uploaded image, so a crafted binary can yield persistent, privileged control of the router. Talos rates it CVSS 3.1 base 9.1, though the practical barrier is the PR:H administrative prerequisite; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
Unauthenticated attackers can bypass JWT signature verification in Eclipse ioFog Controller 3.8.0 through 3.9.1 on the operator WebSocket upgrade handlers for the exec and log routes, allowing them to open privileged sessions for any microservice or fog node whose UUID they know. By crafting a token with an 'admin' group claim, the attacker matches the built-in admin role without needing an account or RoleBinding. No public exploit identified at time of analysis, but the flaw is rated CVSS 9.8 and requires immediate attention.
Unauthenticated attackers can bypass signature verification in FlexPrice's QuickBooks webhook handler (HandleQuickBooksWebhook) through version 2.1.38 by omitting the intuit-signature header, enabling forged payment notifications that can mark invoices paid or overpaid. Exploitation requires knowledge of a valid tenant and environment ID and an active, network-reachable QuickBooks integration; deployments not using QuickBooks webhooks are unaffected. No public exploit identified at time of analysis, though a public technical write-up is available, and this is a credible, moderate-to-high integrity risk.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Authentication bypass in Microsoft .NET allows an unauthenticated, remote attacker to forge a cryptographic signature and have it accepted by applications that rely on the framework's signature-verification routines, potentially leading to unauthorized access or token misuse. The JWT Attack tag points to a token-signature validation weakness; exploitation requires the target application or user to process the attacker-supplied signed token (UI:R), which limits reachability for purely passive endpoints. Affected versions include .NET 10.0 before 10.0.402, .NET 11.0 before 11.0.100-rc.2, and the listed Visual Studio 2022 17.14.x/2026 18.10.x builds; vendor patches are available, and no public exploit identified at time of analysis.
Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
Privilege elevation in Microsoft Exchange Server lets an authenticated low-privilege attacker forge or tamper with a signed security token that the server improperly validates, achieving full compromise of confidentiality, integrity, and availability on the affected build (CVSS 3.1 base 7.5, CWE-347). The flaw affects Exchange Server 2016 CU23 (below 15.01.2507.077), Exchange Server 2019 CU14 (below 15.02.1544.050) and CU15 (below 15.02.1748.055), and Exchange Server Subscription Edition RTM (below 15.02.2562.056); fully patched builds are not exploitable. Exploitation requires a pre-existing low-privilege identity on the server plus conditions outside the attacker's control (AC:H), CISA's SSVC rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Unauthorized privilege elevation in Microsoft SharePoint is possible through improper verification of cryptographic signatures, allowing unauthenticated remote attackers to forge authentication tokens and gain elevated access. Rated CVSS 8.1, the flaw requires high attack complexity but no user interaction, and the JWT-attack tag indicates it likely involves defeating JSON Web Token signature checks. No public exploit has been identified at time of analysis.
Improper verification of cryptographic signatures across the DigiDoc suite lets an attacker craft a document carrying a forged XAdES signature that affected software displays as valid, undermining the integrity of electronically signed documents (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - pure integrity impact with no confidentiality or availability effect). The defect is reachable by unauthenticated remote attackers (PR:N) with no user privilege or special configuration, but exploitation still requires a relying party to validate the forged file with an unpatched build: libdigidocpp before 4.5.0, DigiDoc4 before 4.11.0, or DigiDoc for Android/iOS before 3.1.0. Vendor fixes are available per the ENISA-referenced disclosure and upstream PR; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Improper signature verification in hyper-mcp through 0.8.3 lets an attacker who controls or substitutes the OCI plugin image reference load a malicious WebAssembly plugin, because cosign_verify_args() accepts any signer identity and any OIDC issuer by default - so a plugin image signed with an ordinary, freely obtainable Sigstore keyless certificate passes verification. Successful exploitation allows the malicious plugin to execute with whatever host, filesystem, and environment capabilities the operator has granted to plugins, yielding high integrity impact with limited confidentiality exposure. No public exploit code has been identified at time of analysis; exploitation is gated by the attacker's ability to gain control of the image reference the target resolves (as reflected by the AT:P attack-requirement metric), and blast radius is bounded by the privileges a least-privilege deployment actually grants plugins.
Cryptographic signature spoofing in the Sipay Virtual POS Module for PrestaShop (versions 26.8.1 up to but not including 26.9.1) allows unauthenticated remote attackers to forge or bypass the module's signature verification of payment data, letting them inject fabricated signed payment/JWT payloads that the store treats as legitimate gateway traffic and thereby tamper with payment and order state. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is network-reachable with no authentication and no user interaction, and the integrity impact is the dominant concern; the exposure is limited to merchants who have the Turkish Sipay payment-gateway module installed and active at an affected version, not default PrestaShop installations. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this issue.
Signature spoofing in the Sipay Electronic Money and Payment Services OpenCart Virtual POS Module (versions 26.8.2 up to but not including 26.9.1) lets unauthenticated remote attackers bypass cryptographic signature verification and submit forged or tampered payment tokens, most plausibly spoofed JWTs in the payment callback/token-verification flow, which can expose payment data and permit unauthorized manipulation of transaction processing. The flaw is network-reachable with no authentication or user interaction required (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, CWE-347), and an independent assessment narrows the impact to high confidentiality and integrity loss without an availability component, giving a 9.1-equivalent severity rather than the originally cited 9.8. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, but exploitation requires only that a store runs the vulnerable module version with its callback endpoint reachable. Reported by TR-CERT; a vendor fix is available in 26.9.1.
Signature-verification bypass in NearForm fast-jwt 6.2.4 lets a remote, unauthenticated attacker forge HS256-signed JWTs with arbitrary claims when the application supplies a raw serialized public JWK or JWKS JSON string as the verifier key and HS256 (or another HS* algorithm) is allowed or auto-inferred. Because JWK public material is public by design, those exact JSON bytes become the HMAC secret, so the attacker can mint tokens that createVerifier accepts - the affected configuration is narrow but the impact is a full authentication/authorization bypass. Exploitation requires the attacker to reproduce the victim's exact serialized bytes (property ordering and whitespace must match), and publicly available exploit code exists; CISA KEV does not list this CVE and EPSS data was not provided. Version 6.3.0 fixes the flaw. CWE-347 (Improper Verification of Cryptographic Signature).
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated attacker forge valid HS256 JWTs using the service's own RSA public key, because non-whitespace bytes ahead of the PEM header cause the library to misclassify the public key as an HMAC shared secret. Exploitation is not trivial and depends on two preconditions being met at once: the verifier must load the asymmetric key from a source that left content such as a '#' or '//' comment line, an HTTP-style header, a PGP/text wrapper, or control or zero-width Unicode (NUL, ESC, U+200B, U+200D, U+FEFF) before '-----BEGIN PUBLIC KEY-----', and the verifier must infer or allow HS256 rather than enforcing an asymmetric-only algorithm allowlist; clean PEM keys and asymmetric-only configurations are not affected. Publicly available exploit code exists (a working PoC is included in the vendor GHSA advisory), no CISA KEV listing or active exploitation is indicated, and the supplied 9.8 CVSS overstates real-world exploitability - the independently assessed vector is AV:N/AC:H/PR:N/UI:N with no availability impact, consistent with the two hard preconditions above.
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows a remote authenticated attacker to have forged or tampered cryptographic signatures accepted by the gateway, defeating the trust checks those signatures are meant to enforce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1), the attacker must already hold valid low-privilege credentials and have network reachability to the gateway, but no user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability effect. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the primary limiting factor is the authentication prerequisite, which excludes fully unauthenticated external attackers.
Authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers forge JSON Web Signatures and present themselves as a trusted, already-verified identity on gateways that use JWS/JWT signature verification for access control. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) exploitation requires no credentials or user interaction and the impact is integrity-only, meaning the payoff is forged trust and unauthorized access rather than direct data disclosure. No public exploit identified at time of analysis, EPSS is low at 0.20% (9th percentile), and the CISA SSVC assessment records exploitation as none with automation not feasible, so this is a genuine but moderate-priority issue rather than a top-tier emergency; vendor patches are nonetheless available.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Local privilege escalation in the HPE Aruba ClearPass Policy Manager Windows client software (CVSS 7.8, High) allows an attacker who already holds a low-privileged account on an affected Windows host to run attacker-supplied code with elevated privileges. The flaw is a missing integrity verification weakness: a file or component consumed by the client is loaded or executed with high privileges without being validated first, so an authenticated local user (PR:L, AV:L, UI:N per the assessed vector) can substitute a crafted component and gain SYSTEM-level execution. No remote path exists, the host must have the ClearPass Windows client installed, and no public exploit code or active exploitation has been identified at time of analysis; HPE's bulletin hpesbnw05158en_us is the authoritative source for fixed releases and affected version detail.
Signature-verification bypass in Bouncy Castle for Java before 1.86 lets a phantom signer be accepted in BLS12-381 aggregate signature verification. The faulty BLS12_381BasicScheme.keyValidate() trusts the public key's own ECCurve object during the prime-order subgroup check, so an attacker-supplied ECPoint built on a foreign curve that merely shares BLS12-381's field characteristic - with its cofactor forged to 1 - passes validation despite not being a G1 point; in the pairing implementation such a point contributes the identity in the target group, so an aggregate signature verifies even though it contains no signature for that key/message pair. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key, since the standard 48-byte compressed-point decoder always supplies the canonical curve; no public exploit has been identified at time of analysis, and the assessed impact is high integrity compromise without confidentiality or availability loss (CVSS:4.0 base 7.1, network vector, no privileges required).
Firmware images pushed to Moxa MGate MB3170 and MB3270 series protocol gateways are not cryptographically validated before installation, so a modified or counterfeit image is flashed with the same trust as a vendor-signed one. Exploitation requires an attacker to already hold high-privilege (administrative) access to the device's firmware update interface and to reach it over the network; once that access exists, no additional weakness is needed and no user interaction is required. Successful abuse yields code execution on the gateway plus persistence across subsequent firmware updates, but the impact is confined to the device itself rather than downstream OT systems. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. This is a genuine but access-gated integrity flaw rather than a mass-exploitation threat.
Unauthenticated remote code execution affects endpoints where the Thales SConnect native host component is installed, with an attacker reaching the host through an unrestricted browser native-messaging interface from a malicious or compromised web page. Exploitation requires no credentials (CVSS vector PR:N) and only passive user interaction - the victim must visit or be redirected to an attacker-controlled page - after which crafted input bypasses the component's security checks and, per the reported analysis, chains an improper cryptographic signature verification flaw (CWE-347) with memory-management issues to achieve code execution in the native host's context. Only systems that actually deploy SConnect (a smart-card authentication component, not present by default on general endpoints) are exposed, and there is no public exploit identified at time of analysis, though the severity is rated 9.4 under CVSS 4.0 and the reported vendor is Thales.
In Tugtainer versions before 1.31.3, the OIDC login flow accepts unverified JWT claims from the identity provider's id_token, allowing an unauthenticated remote attacker who can influence the token exchange to impersonate any identity and gain full control of the Tugtainer session. The flaw is a pre-authentication authentication bypass (CWE-347) with high confidentiality, integrity, and availability impact once triggered; exploitation requires OIDC to be configured and enabled. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV. A vendor patch is available in version 1.31.3.
Signature forgery in PyJWT 2.13.0 lets an attacker forge arbitrary JWT claims when an application verifies tokens using both HMAC and asymmetric algorithms and hands a public JWK container (a JWKS document, a bare array, a nested array, or a BOM-prefixed variant) directly to the library as the raw key. Because the version 2.13.0 HMAC key guard only recognizes top-level public JWK objects and misses these container wrappers, public asymmetric key material - which is not secret - is accepted as the HMAC secret, so anyone who knows the target's public key can sign a token with any claims and have it validate. The flaw is an improper-signature-verification issue (CWE-347) rated CVSS 3.1 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and unauthenticated in the sense that no credentials are needed, but real-world urgency is lower than the headline score: exploitation requires a non-default application design that mixes algorithm families and passes container-form keys, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: PyJWT 2.14.0.
Token forgery in PyJWT 2.13.x lets unauthenticated remote attackers mint tokens that the library will accept as authentic: when a public JWK is prefixed with a UTF-8 byte-order mark and passed directly as the raw HMAC secret inside a mixed-algorithm verification path, HMACAlgorithm.prepare_key fails to recognize the material as an asymmetric key and uses the publicly known JWK bytes as the shared secret, so anyone who knows the public key can sign arbitrary claims that verify successfully. The flaw carries an assessed CVSS of 7.4 (integrity-only impact, AC:H, PR:N) and per our independent assessment is conditionally scoped: it requires PyJWT 2.13.0 through 2.13.x, an application that permits HMAC alongside asymmetric algorithms, code that hands a raw public JWK to prepare_key instead of loading it via PyJWK/HMACAlgorithm.from_jwk, and BOM-prefixed key material. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the vendor-released patch is 2.14.0.
Signature forgery in the PyJWT Python library (versions 2.4.0 through 2.13.x) lets a remote, unauthenticated attacker mint forged HMAC tokens whenever an application is misconfigured to accept both HMAC and asymmetric algorithms and passes a DER-encoded public key as the shared verification secret. PyJWT's HMACAlgorithm.prepare_key only rejected PEM- and SSH-formatted asymmetric keys using textual markers, so a DER public key (SubjectPublicKeyInfo, PKCS1, or a DER x509 certificate) slipped through and its public bytes were used directly as the HMAC secret - meaning anyone who knows the public key can sign valid tokens. The flaw is rated CVSS 7.4 with High attack complexity precisely because it requires that specific non-default application configuration; no public exploit code has been identified at time of analysis, and the vendor-released patch is PyJWT 2.14.0.
Signature forgery in PyJWT before 2.14.0 allows an attacker who knows a target's asymmetric public key to forge HMAC-authenticated JWTs when the application mixes HMAC and asymmetric algorithms and passes asymmetric public-key PEM bytes into HMAC verification. The flaw is in is_pem_format in jwt/utils.py, which fails to recognize all PEM formatting variants accepted by the cryptography loader, causing HMACAlgorithm.prepare_key to treat a mutated public-key PEM as an HMAC secret. Exploitation requires a specific non-default deployment pattern-mixed algorithm verification with raw PEM key bytes-and the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; no public exploit identified at time of analysis, and no CISA KEV status was provided.
Forged HS256 JSON Web Tokens can be accepted as authentic by PyJWT (pip package PyJWT) versions 2.13.0 through 2.13.x when an application verifies tokens through the PyJWK or PyJWKSet path and its trusted JWK Set already contains a symmetric oct entry with an empty key value ({"kty":"oct","k":""}), an unusual precondition typically caused by a missing Base64URL configuration or secret-manager value. Because the PyJWK verification path passes the decoded zero-length key straight to the HMAC check instead of running it through HMACAlgorithm.prepare_key, unauthenticated remote attackers (CVSS PR:N) who know this pre-existing misconfiguration can independently compute HMAC-SHA256(b"", signing_input) and mint valid tokens carrying arbitrary authenticated claims, giving high confidentiality and integrity impact. Public proof-of-concept exploit code exists, but the issue is not in CISA KEV, EPSS is low at 0.18% (6th percentile), and the independent assessment rates attack complexity as High rather than Low, so the headline CVSS 9.1 overstates real-world urgency; the vendor-released patch is version 2.14.0 (commit f91ed44dd65baaf457f4b3353ed35e98a753934c).
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticated remote attacker bypass authentication and impersonate an arbitrary Cloudflare service token in applications using the Cloudflare Zero Trust service-token strategy. Because verify_token/2 pattern-matches the {_, token, _s} tuple returned by JOSE.JWT.verify/2, the boolean signature-verification result is discarded and a forged JWT sent in the cf-access-jwt-assertion header is accepted as authenticated identity; the attacker only needs the expected iss claim plus the seven service-token claims (aud, common_name, exp, iat, iss, sub, type). No public exploit code has been identified at time of analysis, but the flaw is remotely reachable with no authentication or user interaction (assessed CVSS 3.1 base 9.3, scope changed) and is fixed in nimble_zta 0.1.3.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
Authentication bypass in the Mnemosyne sync server (mnemosyne-memory through v3.10.0) lets an unauthenticated, network-positioned attacker forge a JWT bearer token - including one using alg: none or signed with the wrong key - and impersonate any user_id to read that victim's synchronized memory state or push malicious state that corrupts their local database. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact, the flaw is remediated in v3.10.1, and a token-forging reproduction is published in the vendor's GHSA-xcw4-53cc-hv32 advisory, meaning publicly available exploit code exists, although no confirmed active exploitation has been reported. Practical exploitability is governed entirely by network exposure: deployments that bind the sync endpoint to localhost, front it with mTLS, or firewall it to trusted clients are not reachable and the vendor explicitly notes the issue 'is not exploitable against an unreachable endpoint,' reducing effective severity to High or Medium for those configurations.
Root shell compromise of NetBackup Flex OS appliances is possible for authenticated, low-privileged users who have access to the NetBackup Flex OS management shell. By supplying a specially formed access credential, such a user can bypass the cryptographic signature verification step of a privileged support command (CWE-347), gaining unrestricted root control over the Flex appliance host and all hosted containers, with complete confidentiality, integrity, and availability impact. The vendor CVSS 4.0 score is 9.4 (PR:L, no user interaction); supplied intelligence does not indicate CISA KEV active exploitation or publicly available exploit code, so no public exploit identified at time of analysis.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
Any authenticated user of a Payload CMS instance running @jhb.software/payload-cloudinary-plugin (0.3.0 through 0.3.x, fixed in 0.4.0) can obtain a cryptographically valid Cloudinary HMAC-SHA1 upload signature for parameters of their choosing, because the client-upload signing endpoint POST /api/cloudinary-generate-signature forwards attacker-controlled 'paramsToSign' straight to cloudinary.utils.api_sign_request() with no key allowlist, folder policy, or timestamp check. With that signature plus the intentionally client-visible Cloudinary API key, an attacker can overwrite existing assets, flip upload visibility with type=private, register notification_url callbacks to attacker-chosen hosts, force cache invalidation, and write files outside the intended upload folder. The issue is only reachable when the plugin's clientUploads option is enabled, and no public exploit code or active-exploitation reporting was present in the supplied intelligence.
JWT signature bypass in Apache Syncope's SRA (Syncope Reverse Application) component enables unauthenticated network attackers to forge arbitrary JWT bearer tokens when the OAuth 2.0 integration is configured without a JWKS set URI, effectively eliminating all cryptographic identity verification for services proxied through SRA. The vulnerability spans three release lines - 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 - and vendor-released fixes are available in 4.0.8 and 4.1.3. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis.
Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. CVSS S:C (scope changed) reflects that driver-level execution escapes application boundaries and achieves OS/kernel-level impact. No public exploit or KEV listing has been identified at time of analysis.
SAML response tampering in HPE IceWall identity and access management products enables a low-privileged attacker to forge authentication assertions and impersonate arbitrary users across federated SSO sessions. The flaw (CWE-347) reflects improper cryptographic signature verification on SAML responses, meaning a tampered assertion can be accepted as legitimate by the IceWall service provider. No public exploit has been identified at time of analysis, but the low attack complexity and fully network-accessible attack surface make this a high-priority remediation for any organization running IceWall-based SSO.
Signature verification bypass in the OCaml jose library (ulrikstrid/ocaml-jose) before 0.11.0 lets attackers forge valid RSA-signed JWS/JWT tokens. The RSA verify path in Jws.ml only confirmed that PKCS #1 decoding succeeded and then returned success, never performing the RSA public-key operation that actually authenticates the signature. Any attacker can craft a token with an arbitrary payload and a syntactically well-formed but cryptographically meaningless signature and have it accepted as valid; no public exploit identified at time of analysis, but the flaw is trivially exploitable once understood.
Authentication bypass in the passport-saml-encrypted Node.js/Passport SAML strategy (versions through 0.1.13) lets a remote attacker impersonate arbitrary users via classic XML Signature Wrapping (XSW). Because signature verification and assertion extraction perform independent, uncorrelated XPath lookups, an attacker who possesses any single validly signed SAML message can prepend a forged, unsigned assertion that the application accepts as the authenticated identity while the genuine signature still validates against the untouched original assertion. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; reported by VulnCheck.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Improper verification of cryptographic signatures in the MQTT command handler of Trueview T18161 S firmware 6.0.23.4 lets a network-positioned attacker replay or tamper with captured MQTT messages — including their nonce, timestamp, and signature fields — and have the device accept and execute the embedded commands. The flaw (CWE-347) yields high
Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.
Token forgery in python-jose through 3.5.0 lets an attacker who possesses the service's asymmetric public key mint valid HS256 (HMAC) JWTs, because the library's HMAC key initialization accepts DER-encoded public keys that lack PEM armor or SSH prefixes and never rejects them as asymmetric material. This is a classic JWT algorithm-confusion (RSA/EC-to-HMAC) attack that succeeds whenever the verifying application does not explicitly restrict the accepted algorithms, and it represents an incomplete fix for CVE-2024-33663. There is no public exploit identified at time of analysis, though the technique is well-documented and the same class of flaw has prior public tooling.
RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to craft signatures that pass verification against arbitrary messages when the verifying party uses low-exponent RSA keys (e=3). The root cause is missing element-count validation inside nested DigestAlgorithm ASN.1 sequences: forge's `_parseAllDigestBytes` mode confirms all bytes are consumed but does not enforce the canonical minimal DigestInfo shape required by RFC 8017, allowing garbage bytes inside the DigestAlgorithm container to survive verification while OpenSSL rejects the same structure. This is explicitly described as an incomplete fix for CVE-2026-33894; a working proof-of-concept is documented in the linked GHSA advisory; no public exploit identified in CISA KEV at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Authentication bypass in oidcc (Erlang/Elixir OpenID Connect library) versions 3.2.0-beta.1 through before 3.9.0 allows unauthenticated attackers to impersonate arbitrary users by presenting a JWE-encrypted ID token or JARM response that wraps unsigned claims, which the library incorrectly accepted as fully validated. The relying party's public encryption key - typically published at a well-known JWKS endpoint - is all an attacker needs to forge tokens with arbitrary sub, iss, and aud values, bypassing provider signing-key possession entirely. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the impact for affected deployments using encrypted ID tokens or JARM is complete authentication bypass.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Privilege escalation in HP OMEN Gaming Hub prior to version 1101.2608.0.0 allows local attackers holding standard user credentials to gain elevated system access by exploiting improper JWT signature verification (CWE-347). The gaming hub service, which operates with elevated OS privileges to manage hardware performance settings on HP OMEN systems, fails to validate cryptographic signatures on JWT tokens used for internal access control, enabling privilege claim forgery. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAML responses and authenticate as any user against the management server without valid credentials. The flaw stems from improper cryptographic signature verification (CWE-347): the management server fails to validate SAML response certificates, so a forged assertion passes unchecked. Exploitation requires either spoofing the IdP's IP address or registering a controlled URL as a trusted IdP endpoint in the management server - conditions that raise the practical bar but, if met, yield full administrative access. No public exploit or CISA KEV listing has been identified; the EPSS score of 0.07% reflects minimal observed exploitation at time of analysis.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Authentication bypass and token replay in node-opcua's UserNameIdentityToken handler enables unauthenticated remote attackers to authenticate as any user whose account accepts an empty password, and to replay captured session tokens unconditionally across unrelated sessions. Versions up to and including 2.165.0 of the npm package are affected. The vulnerability is compounded when SecurityMode=None is configured, which causes the channel-level signature verification to return true unconditionally. A proof-of-concept attack sequence has been dynamically confirmed by the reporter; no vendor-released patch has been identified at time of analysis.
Authentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26, lets a remote unauthenticated attacker gain full administrative access by presenting a forged JWT whose RSA signature is invalid. The flaw lives in the signature-verification logic of jst_functions.c, which accepts tokens without properly validating the RSA signature. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the CVSS 9.8 rating and trivial exploitation path make it a high-priority patch for exposed devices.
Unsigned x-amz-* header injection in Ceph Object Gateway (RGW) SigV4 allows any holder of a presigned URL to attach arbitrary unsigned x-amz-* headers - such as ACL grants, copy-source directives, or storage-class overrides - that RGW silently honors without verifying they were covered by the original cryptographic signature. Affected versions are Ceph prior to 19.2.6 and prior to 20.2.4; the flaw directly enables privilege escalation beyond the permissions the URL signer intended. No public exploit code or active exploitation is confirmed at time of analysis, and vendor-released patches for both stable branches are available.
Multiple cryptographic implementation defects in the libcrux Rust crates - libcrux-ecdh, libcrux-ed25519, and libcrux-psq - expose applications to availability failures and potential key-material weaknesses. libcrux-ecdh omitted length validation and clamping enforcement on X25519 secret inputs (including a broken clamping check for imported keys), libcrux-ed25519 applied a duplicated clamping step during key generation that could silently corrupt key material, and libcrux-psq panicked on AEAD decryption errors instead of returning them to callers. Vendor-released patch versions 0.0.6 (ecdh, ed25519) and 0.0.7 (psq) resolve all three defects; no public exploit code or CISA KEV listing has been identified at time of analysis.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with ciphertext in transit defeat integrity protection, because a failed AES-GCM authenticated decryption in pqc.py silently falls back to unauthenticated AES-CTR. Reported by VulnCheck and carrying a CVSS 4.0 base score of 9.3, the flaw enables undetected bit-flipping and ciphertext manipulation. No public exploit identified at time of analysis, but a vendor patch is available.
Secret disclosure affects the openssl_encrypt Python library (all versions before 1.4.0), where PublicKeyBundle.from_dict() constructs key bundles from untrusted serialized data without validating the embedded self-signature, and to_identity() then promotes that unverified bundle into a usable Identity. An application that deserializes an attacker-supplied bundle and encrypts to it - without an intervening verify_signature() call - will encrypt secrets to an attacker-controlled public key, allowing the attacker to decrypt them. Reported by VulnCheck and fixed in 1.4.0; no public exploit has been identified at time of analysis.
Key-based authorization bypass in @fastify/jwt before 10.2.2 permits any low-privileged authenticated user holding a token signed by the application's global secret to access routes explicitly restricted to a separate per-request key, silently crossing a cryptographic trust boundary. Applications implementing multi-domain JWT authorization - for example, separating user and admin token verification keys - are specifically at risk, as the plugin's option merge incorrectly applies the global key last, overriding the developer-supplied per-request key. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the fix is available in version 10.2.2 and the attack path is mechanically straightforward for any authenticated user.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Signature verification bypass in the PAX Technology Q80 payment terminal's application installer enables network-adjacent unauthenticated attackers to install unsigned or malicious applications, which when chained with a secondary vulnerability results in arbitrary code execution at the root privilege level. The flaw stems from the installer's failure to properly validate cryptographic signatures - tagged as a JWT attack vector - before accepting and executing application packages. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the formal ZDI advisory ZDI-26-526 publicly discloses the vulnerability details.
Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.
Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically crafted forged sumdb tile pairs, exploiting CWE-347 (improper cryptographic verification) in the cmd/go toolchain's tile-parent validation logic. Affected are cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3 - any developer workstation or CI/CD pipeline using these versions and a non-default GOPROXY is at risk of silently caching attacker-controlled module content that cannot be distinguished from legitimate modules through normal transparency log evaluation. No public exploit has been identified and no CISA KEV listing exists; EPSS of 0.12% (3rd percentile) indicates low current exploitation probability, but the theoretical supply chain impact is severe.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status.
JFrog Artifactory's JWT handling allows a holder of a valid integration credential to impersonate arbitrary users under specific conditions, exploiting an improper cryptographic signature verification flaw (CWE-347). Any actor in possession of a legitimate integration token - such as a CI/CD service account - can craft or manipulate JWT tokens to assume the identity of other users, including privileged ones, gaining their full access to repositories and administrative functions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, the full C:H/I:H/A:H CVSS impact profile warrants prompt patching in environments where integration credentials are broadly distributed.
SAML response impersonation in JFrog Artifactory (all tracked versions per CPE) permits an attacker who possesses a valid SAML response to assume the identity of another user under specific conditions. Rooted in CWE-347 (Improper Verification of Cryptographic Signature), the flaw indicates Artifactory fails to adequately validate SAML assertion signatures or cryptographic bindings - a class of weakness commonly exploited via XML Signature Wrapping (XSW) or assertion replay attacks. The 'JWT Attack' tag suggests Artifactory may internally convert SAML assertions to JWT tokens, and the signature verification gap may exist at that translation layer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SAML authentication bypass in PicketLink's Service Provider signature validation allows a network-accessible attacker with low privileges to forge a SAML response and authenticate as any principal with any role on the protected application. The flaw, rooted in CWE-347 (Improper Verification of Cryptographic Signature), arises because the signature check vacuously passes when the SAML response contains zero matching assertion elements, giving the attacker full control over identity and role claims presented to the SP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact on confidentiality and integrity make this a critical authentication control failure.
Authentication bypass in Red Hat PicketLink Federation's SAML implementation lets unauthenticated remote attackers impersonate any principal in any role, because the unsolicited (IdP-initiated) response handler accepts forged SAML assertions without verifying their signature or validating their contents. Successful exploitation yields full identity spoofing, enabling information disclosure and access to restricted operations. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial-to-forge nature make this a high-priority flaw for any application relying on PicketLink SAML SSO.
Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-privileged network attackers to forge or manipulate JWT tokens, bypassing authentication and authorization controls. The vulnerability maps to CWE-347 and is tagged as a JWT attack vector capable of authentication bypass, with high confidentiality and integrity impact confirmed in the vendor's own CVSS 4.0 assessment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a meaningful risk for any organization running affected Pega Infinity deployments.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.
A signature-verification bypass in the update-installation functionality of Nozomi Networks Guardian and CMC before 26.4.0 allows an attacker who already holds administrative privileges on the appliance to supply a crafted update bundle that passes signature checks while carrying an unsigned script, which then executes with root privileges at install time. Successful exploitation gives full read and write access to sensitive data, the ability to alter appliance configuration, or to shut the appliance down (CWE-347, CVSS 4.0 7.5 with PR:H and AT:P; independent assessment scores it CVSS 3.1 7.5 with C:H/I:H/A:H). The prerequisite is significant - administrative authentication and access to the update-installation path are mandatory, and no unauthenticated route is described - and no public exploit has been identified at time of analysis, though the vendor fix in 26.4.0 should be applied this week per the current priority decision.
Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis.
Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present.
Unauthenticated role forgery in Apache Pulsar lets a client present a forged or unsigned JSON Web Token listing arbitrary roles and have those roles honored when the broker uses MultiRolesTokenAuthorizationProvider alongside a non-empty anonymousUserRole. The flaw is reachable over the broker's HTTP surfaces, including the admin REST API and the WebSocket API, where failed credentials can fall back to the anonymous role while the original Authorization header is retained and later trusted without signature verification; an attacker who names a role configured in superUserRoles can obtain super-user access to tenants, namespaces, topics, permissions and broker configuration. Only deployments combining MultiRolesTokenAuthorizationProvider with a non-empty anonymousUserRole and the fallback conditions are exposed, while installations using the default PulsarAuthorizationProvider, another authorization provider, or an unset anonymousUserRole are unaffected. Vendor-released patch: 4.0.14 and 4.2.5; no public exploit identified at time of analysis, and exploitation also requires the specific non-default configuration described.
Unsigned firmware images are accepted and flashed by the boa-based firmware update handler on TOTOLINK X2000R routers running build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, allowing an attacker who already holds administrative web-interface credentials to install arbitrary firmware. The flaw is an improper verification of cryptographic signature (CWE-347): the device performs no meaningful code-signing check on the uploaded image, so a crafted binary can yield persistent, privileged control of the router. Talos rates it CVSS 3.1 base 9.1, though the practical barrier is the PR:H administrative prerequisite; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
Unauthenticated attackers can bypass JWT signature verification in Eclipse ioFog Controller 3.8.0 through 3.9.1 on the operator WebSocket upgrade handlers for the exec and log routes, allowing them to open privileged sessions for any microservice or fog node whose UUID they know. By crafting a token with an 'admin' group claim, the attacker matches the built-in admin role without needing an account or RoleBinding. No public exploit identified at time of analysis, but the flaw is rated CVSS 9.8 and requires immediate attention.
Unauthenticated attackers can bypass signature verification in FlexPrice's QuickBooks webhook handler (HandleQuickBooksWebhook) through version 2.1.38 by omitting the intuit-signature header, enabling forged payment notifications that can mark invoices paid or overpaid. Exploitation requires knowledge of a valid tenant and environment ID and an active, network-reachable QuickBooks integration; deployments not using QuickBooks webhooks are unaffected. No public exploit identified at time of analysis, though a public technical write-up is available, and this is a credible, moderate-to-high integrity risk.
A signature-verification bypass in the CAI Content Credentials SDK allows an unauthenticated, network-reachable attacker to submit content or a token bearing a forged or tampered cryptographic signature that the SDK's verifier accepts, yielding unauthorized write access to systems that rely on that verification as a trust decision. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) the attack needs no credentials and no user interaction, and the assessment confines impact to integrity only, with no confidentiality or availability loss. The practical exposure is narrow but real: only deployments that actually consume the SDK to validate signatures or claims as a security control are affected, and no public exploit code was identified at time of analysis, so this is a genuine integrity issue rather than an acute emergency.
Improper verification of cryptographic signatures in the CAI Content Credentials SDK allows unauthenticated remote attackers to supply forged or improperly signed content credentials that the SDK accepts as authentic, bypassing the security check and gaining unauthorized write access to whatever the SDK's verification verdict gates. The CVSS 3.1 base score is 7.5 (High) under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - an integrity-only signature-verification bypass (CWE-347) with no confidentiality or availability impact, requiring no authentication and no user interaction. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; real-world risk is highest in deployments that make publishing, authorization, or authenticity decisions solely on the SDK's verification result, and negligible where that result is not treated as a trust boundary.
Improper verification of cryptographic signatures in Adobe's CAI Content Credentials SDK allows remote, unauthenticated attackers to submit a forged or tampered Content Credentials manifest that the SDK accepts as valid, bypassing a security feature and granting unauthorized write access to credential data (CWE-347; CVSS 3.1 7.5). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, no credentials and no user interaction are required, and the impact is integrity-only, with confidentiality and availability unaffected; in practice exploitation depends on the vulnerable SDK version being deployed and the consuming application treating signature verification as a trust boundary. This is a moderate-priority integrity issue rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Signature-verification bypass in Adobe Content Credentials SDK allows unauthenticated, network-based attackers to forge or tamper with signed content credentials, bypassing integrity checks to gain unauthorized write access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a low-complexity flaw with no user interaction and a pure integrity impact. No public exploit code has been identified at time of analysis, but risk is elevated for applications that rely on the SDK's verification result as a trust or authorization decision. Confirm vulnerable SDK versions against Adobe APSB26-163.
Authentication bypass in Microsoft .NET allows an unauthenticated, remote attacker to forge a cryptographic signature and have it accepted by applications that rely on the framework's signature-verification routines, potentially leading to unauthorized access or token misuse. The JWT Attack tag points to a token-signature validation weakness; exploitation requires the target application or user to process the attacker-supplied signed token (UI:R), which limits reachability for purely passive endpoints. Affected versions include .NET 10.0 before 10.0.402, .NET 11.0 before 11.0.100-rc.2, and the listed Visual Studio 2022 17.14.x/2026 18.10.x builds; vendor patches are available, and no public exploit identified at time of analysis.
Spoofing in Microsoft Active Directory Federation Services (AD FS) lets a remote, unauthenticated attacker forge signed tokens that the service accepts as legitimate, yielding full compromise of confidentiality and integrity (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The flaw is an improper verification of cryptographic signatures (CWE-347) in the AD FS token-validation path, tagged as an authentication bypass/JWT attack, so a crafted SAML/JWT assertion can impersonate any user or relying party - effectively bypassing federation authentication. Only hosts running the AD FS role on unpatched Windows Server builds (2012 through 2025) are exposed; organizations that do not deploy AD FS are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC: Exploitation = none, Automatable = yes, Technical Impact = total), but the vulnerability is considered high-priority because exploitation is trivially automatable and impact is total where the role is exposed.
Privilege elevation in Microsoft Exchange Server lets an authenticated low-privilege attacker forge or tamper with a signed security token that the server improperly validates, achieving full compromise of confidentiality, integrity, and availability on the affected build (CVSS 3.1 base 7.5, CWE-347). The flaw affects Exchange Server 2016 CU23 (below 15.01.2507.077), Exchange Server 2019 CU14 (below 15.02.1544.050) and CU15 (below 15.02.1748.055), and Exchange Server Subscription Edition RTM (below 15.02.2562.056); fully patched builds are not exploitable. Exploitation requires a pre-existing low-privilege identity on the server plus conditions outside the attacker's control (AC:H), CISA's SSVC rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Unauthorized privilege elevation in Microsoft SharePoint is possible through improper verification of cryptographic signatures, allowing unauthenticated remote attackers to forge authentication tokens and gain elevated access. Rated CVSS 8.1, the flaw requires high attack complexity but no user interaction, and the JWT-attack tag indicates it likely involves defeating JSON Web Token signature checks. No public exploit has been identified at time of analysis.
Improper verification of cryptographic signatures across the DigiDoc suite lets an attacker craft a document carrying a forged XAdES signature that affected software displays as valid, undermining the integrity of electronically signed documents (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - pure integrity impact with no confidentiality or availability effect). The defect is reachable by unauthenticated remote attackers (PR:N) with no user privilege or special configuration, but exploitation still requires a relying party to validate the forged file with an unpatched build: libdigidocpp before 4.5.0, DigiDoc4 before 4.11.0, or DigiDoc for Android/iOS before 3.1.0. Vendor fixes are available per the ENISA-referenced disclosure and upstream PR; no public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Improper signature verification in hyper-mcp through 0.8.3 lets an attacker who controls or substitutes the OCI plugin image reference load a malicious WebAssembly plugin, because cosign_verify_args() accepts any signer identity and any OIDC issuer by default - so a plugin image signed with an ordinary, freely obtainable Sigstore keyless certificate passes verification. Successful exploitation allows the malicious plugin to execute with whatever host, filesystem, and environment capabilities the operator has granted to plugins, yielding high integrity impact with limited confidentiality exposure. No public exploit code has been identified at time of analysis; exploitation is gated by the attacker's ability to gain control of the image reference the target resolves (as reflected by the AT:P attack-requirement metric), and blast radius is bounded by the privileges a least-privilege deployment actually grants plugins.
Cryptographic signature spoofing in the Sipay Virtual POS Module for PrestaShop (versions 26.8.1 up to but not including 26.9.1) allows unauthenticated remote attackers to forge or bypass the module's signature verification of payment data, letting them inject fabricated signed payment/JWT payloads that the store treats as legitimate gateway traffic and thereby tamper with payment and order state. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is network-reachable with no authentication and no user interaction, and the integrity impact is the dominant concern; the exposure is limited to merchants who have the Turkish Sipay payment-gateway module installed and active at an affected version, not default PrestaShop installations. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this issue.
Signature spoofing in the Sipay Electronic Money and Payment Services OpenCart Virtual POS Module (versions 26.8.2 up to but not including 26.9.1) lets unauthenticated remote attackers bypass cryptographic signature verification and submit forged or tampered payment tokens, most plausibly spoofed JWTs in the payment callback/token-verification flow, which can expose payment data and permit unauthorized manipulation of transaction processing. The flaw is network-reachable with no authentication or user interaction required (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, CWE-347), and an independent assessment narrows the impact to high confidentiality and integrity loss without an availability component, giving a 9.1-equivalent severity rather than the originally cited 9.8. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, but exploitation requires only that a store runs the vulnerable module version with its callback endpoint reachable. Reported by TR-CERT; a vendor fix is available in 26.9.1.
Signature-verification bypass in NearForm fast-jwt 6.2.4 lets a remote, unauthenticated attacker forge HS256-signed JWTs with arbitrary claims when the application supplies a raw serialized public JWK or JWKS JSON string as the verifier key and HS256 (or another HS* algorithm) is allowed or auto-inferred. Because JWK public material is public by design, those exact JSON bytes become the HMAC secret, so the attacker can mint tokens that createVerifier accepts - the affected configuration is narrow but the impact is a full authentication/authorization bypass. Exploitation requires the attacker to reproduce the victim's exact serialized bytes (property ordering and whitespace must match), and publicly available exploit code exists; CISA KEV does not list this CVE and EPSS data was not provided. Version 6.3.0 fixes the flaw. CWE-347 (Improper Verification of Cryptographic Signature).
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated attacker forge valid HS256 JWTs using the service's own RSA public key, because non-whitespace bytes ahead of the PEM header cause the library to misclassify the public key as an HMAC shared secret. Exploitation is not trivial and depends on two preconditions being met at once: the verifier must load the asymmetric key from a source that left content such as a '#' or '//' comment line, an HTTP-style header, a PGP/text wrapper, or control or zero-width Unicode (NUL, ESC, U+200B, U+200D, U+FEFF) before '-----BEGIN PUBLIC KEY-----', and the verifier must infer or allow HS256 rather than enforcing an asymmetric-only algorithm allowlist; clean PEM keys and asymmetric-only configurations are not affected. Publicly available exploit code exists (a working PoC is included in the vendor GHSA advisory), no CISA KEV listing or active exploitation is indicated, and the supplied 9.8 CVSS overstates real-world exploitability - the independently assessed vector is AV:N/AC:H/PR:N/UI:N with no availability impact, consistent with the two hard preconditions above.
Security-restriction bypass in IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 allows a remote authenticated attacker to have forged or tampered cryptographic signatures accepted by the gateway, defeating the trust checks those signatures are meant to enforce. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1), the attacker must already hold valid low-privilege credentials and have network reachability to the gateway, but no user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability effect. No public exploit code was identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the primary limiting factor is the authentication prerequisite, which excludes fully unauthenticated external attackers.
Authentication bypass in IBM DataPower Gateway lets remote, unauthenticated attackers forge JSON Web Signatures and present themselves as a trusted, already-verified identity on gateways that use JWS/JWT signature verification for access control. Affected releases are 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) exploitation requires no credentials or user interaction and the impact is integrity-only, meaning the payoff is forged trust and unauthorized access rather than direct data disclosure. No public exploit identified at time of analysis, EPSS is low at 0.20% (9th percentile), and the CISA SSVC assessment records exploitation as none with automation not feasible, so this is a genuine but moderate-priority issue rather than a top-tier emergency; vendor patches are nonetheless available.
Unauthenticated remote attackers can bypass the cryptographic signature verification on authentication tokens in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem, SSM On-Prem), so a forged JSON Web Token is accepted as authentic and the licensing server can be fully compromised; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0, meaning no credentials and no user interaction are required, low complexity, a scope change, and high impact to confidentiality, integrity and availability. Cisco's internal hardening review addressed this together with other internally discovered issues, and the advisory-linked hardening releases are the fix path, with no exact patched version numbers disclosed in the available data; the practical limiting factor is network exposure of the management/licensing interface, since the attacker must be able to reach the instance. No CISA KEV entry exists and no public exploit code has been identified at time of analysis, so this is a maximum-severity but not yet observed-exploited issue.
Local privilege escalation in the HPE Aruba ClearPass Policy Manager Windows client software (CVSS 7.8, High) allows an attacker who already holds a low-privileged account on an affected Windows host to run attacker-supplied code with elevated privileges. The flaw is a missing integrity verification weakness: a file or component consumed by the client is loaded or executed with high privileges without being validated first, so an authenticated local user (PR:L, AV:L, UI:N per the assessed vector) can substitute a crafted component and gain SYSTEM-level execution. No remote path exists, the host must have the ClearPass Windows client installed, and no public exploit code or active exploitation has been identified at time of analysis; HPE's bulletin hpesbnw05158en_us is the authoritative source for fixed releases and affected version detail.
Signature-verification bypass in Bouncy Castle for Java before 1.86 lets a phantom signer be accepted in BLS12-381 aggregate signature verification. The faulty BLS12_381BasicScheme.keyValidate() trusts the public key's own ECCurve object during the prime-order subgroup check, so an attacker-supplied ECPoint built on a foreign curve that merely shares BLS12-381's field characteristic - with its cofactor forged to 1 - passes validation despite not being a G1 point; in the pairing implementation such a point contributes the identity in the target group, so an aggregate signature verifies even though it contains no signature for that key/message pair. The issue is reachable only where an application constructs an ECPoint on an explicit, non-canonical curve and accepts it as an authority-bearing key, since the standard 48-byte compressed-point decoder always supplies the canonical curve; no public exploit has been identified at time of analysis, and the assessed impact is high integrity compromise without confidentiality or availability loss (CVSS:4.0 base 7.1, network vector, no privileges required).
Firmware images pushed to Moxa MGate MB3170 and MB3270 series protocol gateways are not cryptographically validated before installation, so a modified or counterfeit image is flashed with the same trust as a vendor-signed one. Exploitation requires an attacker to already hold high-privilege (administrative) access to the device's firmware update interface and to reach it over the network; once that access exists, no additional weakness is needed and no user interaction is required. Successful abuse yields code execution on the gateway plus persistence across subsequent firmware updates, but the impact is confined to the device itself rather than downstream OT systems. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied. This is a genuine but access-gated integrity flaw rather than a mass-exploitation threat.
Unauthenticated remote code execution affects endpoints where the Thales SConnect native host component is installed, with an attacker reaching the host through an unrestricted browser native-messaging interface from a malicious or compromised web page. Exploitation requires no credentials (CVSS vector PR:N) and only passive user interaction - the victim must visit or be redirected to an attacker-controlled page - after which crafted input bypasses the component's security checks and, per the reported analysis, chains an improper cryptographic signature verification flaw (CWE-347) with memory-management issues to achieve code execution in the native host's context. Only systems that actually deploy SConnect (a smart-card authentication component, not present by default on general endpoints) are exposed, and there is no public exploit identified at time of analysis, though the severity is rated 9.4 under CVSS 4.0 and the reported vendor is Thales.
In Tugtainer versions before 1.31.3, the OIDC login flow accepts unverified JWT claims from the identity provider's id_token, allowing an unauthenticated remote attacker who can influence the token exchange to impersonate any identity and gain full control of the Tugtainer session. The flaw is a pre-authentication authentication bypass (CWE-347) with high confidentiality, integrity, and availability impact once triggered; exploitation requires OIDC to be configured and enabled. No public exploit has been identified at the time of analysis, and the issue is not listed in CISA KEV. A vendor patch is available in version 1.31.3.
Signature forgery in PyJWT 2.13.0 lets an attacker forge arbitrary JWT claims when an application verifies tokens using both HMAC and asymmetric algorithms and hands a public JWK container (a JWKS document, a bare array, a nested array, or a BOM-prefixed variant) directly to the library as the raw key. Because the version 2.13.0 HMAC key guard only recognizes top-level public JWK objects and misses these container wrappers, public asymmetric key material - which is not secret - is accepted as the HMAC secret, so anyone who knows the target's public key can sign a token with any claims and have it validate. The flaw is an improper-signature-verification issue (CWE-347) rated CVSS 3.1 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and unauthenticated in the sense that no credentials are needed, but real-world urgency is lower than the headline score: exploitation requires a non-default application design that mixes algorithm families and passes container-form keys, and no public exploit code or confirmed active exploitation was identified at time of analysis. Vendor-released patch: PyJWT 2.14.0.
Token forgery in PyJWT 2.13.x lets unauthenticated remote attackers mint tokens that the library will accept as authentic: when a public JWK is prefixed with a UTF-8 byte-order mark and passed directly as the raw HMAC secret inside a mixed-algorithm verification path, HMACAlgorithm.prepare_key fails to recognize the material as an asymmetric key and uses the publicly known JWK bytes as the shared secret, so anyone who knows the public key can sign arbitrary claims that verify successfully. The flaw carries an assessed CVSS of 7.4 (integrity-only impact, AC:H, PR:N) and per our independent assessment is conditionally scoped: it requires PyJWT 2.13.0 through 2.13.x, an application that permits HMAC alongside asymmetric algorithms, code that hands a raw public JWK to prepare_key instead of loading it via PyJWK/HMACAlgorithm.from_jwk, and BOM-prefixed key material. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the vendor-released patch is 2.14.0.
Signature forgery in the PyJWT Python library (versions 2.4.0 through 2.13.x) lets a remote, unauthenticated attacker mint forged HMAC tokens whenever an application is misconfigured to accept both HMAC and asymmetric algorithms and passes a DER-encoded public key as the shared verification secret. PyJWT's HMACAlgorithm.prepare_key only rejected PEM- and SSH-formatted asymmetric keys using textual markers, so a DER public key (SubjectPublicKeyInfo, PKCS1, or a DER x509 certificate) slipped through and its public bytes were used directly as the HMAC secret - meaning anyone who knows the public key can sign valid tokens. The flaw is rated CVSS 7.4 with High attack complexity precisely because it requires that specific non-default application configuration; no public exploit code has been identified at time of analysis, and the vendor-released patch is PyJWT 2.14.0.
Signature forgery in PyJWT before 2.14.0 allows an attacker who knows a target's asymmetric public key to forge HMAC-authenticated JWTs when the application mixes HMAC and asymmetric algorithms and passes asymmetric public-key PEM bytes into HMAC verification. The flaw is in is_pem_format in jwt/utils.py, which fails to recognize all PEM formatting variants accepted by the cryptography loader, causing HMACAlgorithm.prepare_key to treat a mutated public-key PEM as an HMAC secret. Exploitation requires a specific non-default deployment pattern-mixed algorithm verification with raw PEM key bytes-and the assessed CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; no public exploit identified at time of analysis, and no CISA KEV status was provided.
Forged HS256 JSON Web Tokens can be accepted as authentic by PyJWT (pip package PyJWT) versions 2.13.0 through 2.13.x when an application verifies tokens through the PyJWK or PyJWKSet path and its trusted JWK Set already contains a symmetric oct entry with an empty key value ({"kty":"oct","k":""}), an unusual precondition typically caused by a missing Base64URL configuration or secret-manager value. Because the PyJWK verification path passes the decoded zero-length key straight to the HMAC check instead of running it through HMACAlgorithm.prepare_key, unauthenticated remote attackers (CVSS PR:N) who know this pre-existing misconfiguration can independently compute HMAC-SHA256(b"", signing_input) and mint valid tokens carrying arbitrary authenticated claims, giving high confidentiality and integrity impact. Public proof-of-concept exploit code exists, but the issue is not in CISA KEV, EPSS is low at 0.18% (6th percentile), and the independent assessment rates attack complexity as High rather than Low, so the headline CVSS 9.1 overstates real-world urgency; the vendor-released patch is version 2.14.0 (commit f91ed44dd65baaf457f4b3353ed35e98a753934c).
Improper JWT signature verification in Dashbit's nimble_zta (0.1.2 up to but not including 0.1.3) lets an unauthenticated remote attacker bypass authentication and impersonate an arbitrary Cloudflare service token in applications using the Cloudflare Zero Trust service-token strategy. Because verify_token/2 pattern-matches the {_, token, _s} tuple returned by JOSE.JWT.verify/2, the boolean signature-verification result is discarded and a forged JWT sent in the cf-access-jwt-assertion header is accepted as authenticated identity; the attacker only needs the expected iss claim plus the seven service-token claims (aud, common_name, exp, iat, iss, sub, type). No public exploit code has been identified at time of analysis, but the flaw is remotely reachable with no authentication or user interaction (assessed CVSS 3.1 base 9.3, scope changed) and is fixed in nimble_zta 0.1.3.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Improper signature verification in the Notepad++ updater path allows a locally planted or modified GUP.exe updater binary to be accepted and launched even though its Authenticode digest is invalid, affecting versions 8.9.7 up to (but not including) 8.9.8 on Windows and fixed in 8.9.8. Exploitation is not remote and does not by itself yield remote code execution: it requires an attacker who already has the ability to replace or plant the updater-related file in the installation path (typically requiring elevated/admin rights for a default Program Files install, or a user-writable install directory), plus a victim who actively triggers the updater path (user interaction). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); this is a code-signing verification defect rather than a directly reachable remote vulnerability.
Authentication bypass in the Mnemosyne sync server (mnemosyne-memory through v3.10.0) lets an unauthenticated, network-positioned attacker forge a JWT bearer token - including one using alg: none or signed with the wrong key - and impersonate any user_id to read that victim's synchronized memory state or push malicious state that corrupts their local database. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) with no availability impact, the flaw is remediated in v3.10.1, and a token-forging reproduction is published in the vendor's GHSA-xcw4-53cc-hv32 advisory, meaning publicly available exploit code exists, although no confirmed active exploitation has been reported. Practical exploitability is governed entirely by network exposure: deployments that bind the sync endpoint to localhost, front it with mTLS, or firewall it to trusted clients are not reachable and the vendor explicitly notes the issue 'is not exploitable against an unreachable endpoint,' reducing effective severity to High or Medium for those configurations.
Root shell compromise of NetBackup Flex OS appliances is possible for authenticated, low-privileged users who have access to the NetBackup Flex OS management shell. By supplying a specially formed access credential, such a user can bypass the cryptographic signature verification step of a privileged support command (CWE-347), gaining unrestricted root control over the Flex appliance host and all hosted containers, with complete confidentiality, integrity, and availability impact. The vendor CVSS 4.0 score is 9.4 (PR:L, no user interaction); supplied intelligence does not indicate CISA KEV active exploitation or publicly available exploit code, so no public exploit identified at time of analysis.
Improper cryptographic signature verification in the VeloCloud Edge (Arista, formerly VMware/Broadcom SD-WAN) software update workflow allows an attacker who can either upload packages to VeloCloud Orchestrator or authenticate directly to an Edge to install unauthorized software on the appliance. Because the update workflow does not constrain which digest algorithm is used to verify artifacts, a bundle signed with an unexpected or weak digest can be accepted as legitimate, resulting in arbitrary code execution with the privileges of the update process on the SD-WAN edge node. No public exploit code and no CISA KEV listing were present in the provided intelligence, although the required access level (CVSS 4.0 PR:H) means the flaw is most dangerous to insiders or anyone who has already compromised an operator account.
Any authenticated user of a Payload CMS instance running @jhb.software/payload-cloudinary-plugin (0.3.0 through 0.3.x, fixed in 0.4.0) can obtain a cryptographically valid Cloudinary HMAC-SHA1 upload signature for parameters of their choosing, because the client-upload signing endpoint POST /api/cloudinary-generate-signature forwards attacker-controlled 'paramsToSign' straight to cloudinary.utils.api_sign_request() with no key allowlist, folder policy, or timestamp check. With that signature plus the intentionally client-visible Cloudinary API key, an attacker can overwrite existing assets, flip upload visibility with type=private, register notification_url callbacks to attacker-chosen hosts, force cache invalidation, and write files outside the intended upload folder. The issue is only reachable when the plugin's clientUploads option is enabled, and no public exploit code or active-exploitation reporting was present in the supplied intelligence.
JWT signature bypass in Apache Syncope's SRA (Syncope Reverse Application) component enables unauthenticated network attackers to forge arbitrary JWT bearer tokens when the OAuth 2.0 integration is configured without a JWKS set URI, effectively eliminating all cryptographic identity verification for services proxied through SRA. The vulnerability spans three release lines - 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 - and vendor-released fixes are available in 4.0.8 and 4.1.3. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis.
Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. CVSS S:C (scope changed) reflects that driver-level execution escapes application boundaries and achieves OS/kernel-level impact. No public exploit or KEV listing has been identified at time of analysis.
SAML response tampering in HPE IceWall identity and access management products enables a low-privileged attacker to forge authentication assertions and impersonate arbitrary users across federated SSO sessions. The flaw (CWE-347) reflects improper cryptographic signature verification on SAML responses, meaning a tampered assertion can be accepted as legitimate by the IceWall service provider. No public exploit has been identified at time of analysis, but the low attack complexity and fully network-accessible attack surface make this a high-priority remediation for any organization running IceWall-based SSO.
Signature verification bypass in the OCaml jose library (ulrikstrid/ocaml-jose) before 0.11.0 lets attackers forge valid RSA-signed JWS/JWT tokens. The RSA verify path in Jws.ml only confirmed that PKCS #1 decoding succeeded and then returned success, never performing the RSA public-key operation that actually authenticates the signature. Any attacker can craft a token with an arbitrary payload and a syntactically well-formed but cryptographically meaningless signature and have it accepted as valid; no public exploit identified at time of analysis, but the flaw is trivially exploitable once understood.
Authentication bypass in the passport-saml-encrypted Node.js/Passport SAML strategy (versions through 0.1.13) lets a remote attacker impersonate arbitrary users via classic XML Signature Wrapping (XSW). Because signature verification and assertion extraction perform independent, uncorrelated XPath lookups, an attacker who possesses any single validly signed SAML message can prepend a forged, unsigned assertion that the application accepts as the authenticated identity while the genuine signature still validates against the untouched original assertion. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; reported by VulnCheck.
User impersonation in Apache Impala 4.0.0 through 4.5.1 lets a remote attacker act as any user because the final step of SAML2 authentication on the hs2-http interface never verifies the Bearer token's signature. An attacker who can reach a SAML2-enabled hs2-http endpoint can forge or tamper with the token's asserted username and gain that user's identity and privileges. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the issue is not in CISA KEV.
Skype for Business Server's failure to properly verify cryptographic signatures (CWE-347) enables unauthenticated attackers on the same network segment to spoof identities or server endpoints, achieving high confidentiality and integrity impact across three distinct server release lines. All on-premises deployments of SfB Server 2015 CU13, 2019 CU8, and Subscription Edition CU1 below specific cumulative-update thresholds are confirmed affected, with patched releases available from Microsoft. The JWT Attack tag combined with CWE-347 indicates the flaw resides in token signature validation, where the server may accept cryptographically forged or unsigned tokens as legitimate - enabling impersonation without valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Cryptographic signature verification failure in the Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) exposes session or authentication material to network-based interception. The 'Jwt Attack' technique tag combined with CWE-347 indicates the client insufficiently validates JWT signatures used in modern RDP authentication flows - likely those tied to Azure AD/Entra ID single-sign-on - permitting an attacker to intercept or substitute cryptographic tokens. No active exploitation confirmed at time of analysis, but the unauthenticated network vector and high confidentiality impact make this a meaningful priority for organizations relying on the standalone desktop client for cloud or VDI connectivity.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Improper verification of cryptographic signatures in the MQTT command handler of Trueview T18161 S firmware 6.0.23.4 lets a network-positioned attacker replay or tamper with captured MQTT messages — including their nonce, timestamp, and signature fields — and have the device accept and execute the embedded commands. The flaw (CWE-347) yields high
Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.
Token forgery in python-jose through 3.5.0 lets an attacker who possesses the service's asymmetric public key mint valid HS256 (HMAC) JWTs, because the library's HMAC key initialization accepts DER-encoded public keys that lack PEM armor or SSH prefixes and never rejects them as asymmetric material. This is a classic JWT algorithm-confusion (RSA/EC-to-HMAC) attack that succeeds whenever the verifying application does not explicitly restrict the accepted algorithms, and it represents an incomplete fix for CVE-2024-33663. There is no public exploit identified at time of analysis, though the technique is well-documented and the same class of flaw has prior public tooling.
RSA PKCS#1 v1.5 signature forgery in node-forge through v1.4.0 enables unauthenticated network attackers to craft signatures that pass verification against arbitrary messages when the verifying party uses low-exponent RSA keys (e=3). The root cause is missing element-count validation inside nested DigestAlgorithm ASN.1 sequences: forge's `_parseAllDigestBytes` mode confirms all bytes are consumed but does not enforce the canonical minimal DigestInfo shape required by RFC 8017, allowing garbage bytes inside the DigestAlgorithm container to survive verification while OpenSSL rejects the same structure. This is explicitly described as an incomplete fix for CVE-2026-33894; a working proof-of-concept is documented in the linked GHSA advisory; no public exploit identified in CISA KEV at time of analysis.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Unauthenticated stream credential disclosure in AVideo (WWBN, commit e01e41ecc and earlier) lets remote attackers retrieve any user's restream stream_key and stream_url for external platforms like YouTube, Facebook, and Twitch. The getLiveKey.json.php endpoint accepts a 'token' parameter that bypasses both the Live::canRestream() access gate and the restream ownership check, and the token is merely AES-256-CBC encryptString() of an integer id with no user binding, expiry, or authentication tag. Because a public encryption oracle (view/url2Embed.json.php) lets anyone encrypt arbitrary values, valid tokens can be forged with no authentication; no public exploit is identified at time of analysis but the technique is fully described.
Authentication bypass in oidcc (Erlang/Elixir OpenID Connect library) versions 3.2.0-beta.1 through before 3.9.0 allows unauthenticated attackers to impersonate arbitrary users by presenting a JWE-encrypted ID token or JARM response that wraps unsigned claims, which the library incorrectly accepted as fully validated. The relying party's public encryption key - typically published at a well-known JWKS endpoint - is all an attacker needs to forge tokens with arbitrary sub, iss, and aud values, bypassing provider signing-key possession entirely. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the impact for affected deployments using encrypted ID tokens or JARM is complete authentication bypass.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Authentication bypass in the Omnivore API (packages/api) before commit abf53d6 lets a remote unauthenticated attacker impersonate any Apple-linked account through a JWT algorithm-confusion flaw in Apple sign-in. Because decodeAppleToken trusted the attacker-controlled 'alg' header and jsonwebtoken v8 does not enforce key/algorithm compatibility, an attacker can switch the token to HS256 and sign it with Apple's public RSA key used as the HMAC secret. Reported by VulnCheck; no public exploit identified at time of analysis, though the technique is a well-documented class of attack.
Authentication bypass in the WPMU DEV Dashboard WordPress plugin (all versions through 5.0.1) lets an unauthenticated attacker forge a valid administrator session by abusing an HMAC signature-verification flaw in the Hub SSO login flow. Because the signing routine in the unauthenticated wdpsso_step1 action covers a different, unseparated field concatenation than the verifier in wdpsso_step2, an attacker can obtain a legitimately signed token and replay it with fields rearranged to authenticate as admin. No public exploit is identified at time of analysis, but the network-reachable, unauthenticated nature and 9.8 CVSS make this a high-priority patch item.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Privilege escalation in HP OMEN Gaming Hub prior to version 1101.2608.0.0 allows local attackers holding standard user credentials to gain elevated system access by exploiting improper JWT signature verification (CWE-347). The gaming hub service, which operates with elevated OS privileges to manage hardware performance settings on HP OMEN systems, fails to validate cryptographic signatures on JWT tokens used for internal access control, enabling privilege claim forgery. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAML responses and authenticate as any user against the management server without valid credentials. The flaw stems from improper cryptographic signature verification (CWE-347): the management server fails to validate SAML response certificates, so a forged assertion passes unchecked. Exploitation requires either spoofing the IdP's IP address or registering a controlled URL as a trusted IdP endpoint in the management server - conditions that raise the practical bar but, if met, yield full administrative access. No public exploit or CISA KEV listing has been identified; the EPSS score of 0.07% reflects minimal observed exploitation at time of analysis.
Privilege elevation in Microsoft Azure Data Factory allows a remote, unauthenticated attacker to gain elevated privileges by exploiting improper verification of a cryptographic signature. Tagged as a JWT/authentication-bypass issue, the flaw lets an attacker forge or tamper with signed tokens that the service fails to validate correctly, defeating access controls over the network. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%), but the CVSS 9.8 rating reflects total technical impact if exploited.
Authentication bypass and token replay in node-opcua's UserNameIdentityToken handler enables unauthenticated remote attackers to authenticate as any user whose account accepts an empty password, and to replay captured session tokens unconditionally across unrelated sessions. Versions up to and including 2.165.0 of the npm package are affected. The vulnerability is compounded when SecurityMode=None is configured, which causes the channel-level signature verification to return true unconditionally. A proof-of-concept attack sequence has been dynamically confirmed by the reporter; no vendor-released patch has been identified at time of analysis.
Authentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26, lets a remote unauthenticated attacker gain full administrative access by presenting a forged JWT whose RSA signature is invalid. The flaw lives in the signature-verification logic of jst_functions.c, which accepts tokens without properly validating the RSA signature. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the CVSS 9.8 rating and trivial exploitation path make it a high-priority patch for exposed devices.
Unsigned x-amz-* header injection in Ceph Object Gateway (RGW) SigV4 allows any holder of a presigned URL to attach arbitrary unsigned x-amz-* headers - such as ACL grants, copy-source directives, or storage-class overrides - that RGW silently honors without verifying they were covered by the original cryptographic signature. Affected versions are Ceph prior to 19.2.6 and prior to 20.2.4; the flaw directly enables privilege escalation beyond the permissions the URL signer intended. No public exploit code or active exploitation is confirmed at time of analysis, and vendor-released patches for both stable branches are available.
Multiple cryptographic implementation defects in the libcrux Rust crates - libcrux-ecdh, libcrux-ed25519, and libcrux-psq - expose applications to availability failures and potential key-material weaknesses. libcrux-ecdh omitted length validation and clamping enforcement on X25519 secret inputs (including a broken clamping check for imported keys), libcrux-ed25519 applied a duplicated clamping step during key generation that could silently corrupt key material, and libcrux-psq panicked on AEAD decryption errors instead of returning them to callers. Vendor-released patch versions 0.0.6 (ecdh, ed25519) and 0.0.7 (psq) resolve all three defects; no public exploit code or CISA KEV listing has been identified at time of analysis.
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. Two distinct attack paths exist: an on-path attacker who can intercept WireGuard UDP traffic can modify ciphertext and authenticated data without detection, while a remote attacker with knowledge of the receiver's replay window bounds can inject forged transport data packets directly. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating no widespread automated exploitation at time of analysis.
Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).
Authentication bypass in the openssl_encrypt Python library (versions before 1.4.0) lets attackers who can tamper with ciphertext in transit defeat integrity protection, because a failed AES-GCM authenticated decryption in pqc.py silently falls back to unauthenticated AES-CTR. Reported by VulnCheck and carrying a CVSS 4.0 base score of 9.3, the flaw enables undetected bit-flipping and ciphertext manipulation. No public exploit identified at time of analysis, but a vendor patch is available.
Secret disclosure affects the openssl_encrypt Python library (all versions before 1.4.0), where PublicKeyBundle.from_dict() constructs key bundles from untrusted serialized data without validating the embedded self-signature, and to_identity() then promotes that unverified bundle into a usable Identity. An application that deserializes an attacker-supplied bundle and encrypts to it - without an intervening verify_signature() call - will encrypt secrets to an attacker-controlled public key, allowing the attacker to decrypt them. Reported by VulnCheck and fixed in 1.4.0; no public exploit has been identified at time of analysis.
Key-based authorization bypass in @fastify/jwt before 10.2.2 permits any low-privileged authenticated user holding a token signed by the application's global secret to access routes explicitly restricted to a separate per-request key, silently crossing a cryptographic trust boundary. Applications implementing multi-domain JWT authorization - for example, separating user and admin token verification keys - are specifically at risk, as the plugin's option merge incorrectly applies the global key last, overriding the developer-supplied per-request key. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the fix is available in version 10.2.2 and the attack path is mechanically straightforward for any authenticated user.
Red Hat Quay's Stripe billing webhook handler at /webhooks/stripe processes inbound JSON payloads without verifying the Stripe-Signature HMAC header, enabling any network-reachable unauthenticated attacker to forge billing events. Successful exploitation resets the targeted namespace's build quota to its configured maximum and dispatches unsolicited billing notification emails to namespace administrators. No public exploit has been identified and EPSS is 0.14% (4th percentile), but the zero-prerequisite attack path makes exploitation trivially scriptable by any attacker with HTTP access to the endpoint.
Signature verification bypass in the PAX Technology Q80 payment terminal's application installer enables network-adjacent unauthenticated attackers to install unsigned or malicious applications, which when chained with a secondary vulnerability results in arbitrary code execution at the root privilege level. The flaw stems from the installer's failure to properly validate cryptographic signatures - tagged as a JWT attack vector - before accepting and executing application packages. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the formal ZDI advisory ZDI-26-526 publicly discloses the vulnerability details.
Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.
Supply chain compromise of Go module environments is possible when a malicious GOPROXY serves specifically crafted forged sumdb tile pairs, exploiting CWE-347 (improper cryptographic verification) in the cmd/go toolchain's tile-parent validation logic. Affected are cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3 - any developer workstation or CI/CD pipeline using these versions and a non-default GOPROXY is at risk of silently caching attacker-controlled module content that cannot be distinguished from legitimate modules through normal transparency log evaluation. No public exploit has been identified and no CISA KEV listing exists; EPSS of 0.12% (3rd percentile) indicates low current exploitation probability, but the theoretical supply chain impact is severe.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status.
JFrog Artifactory's JWT handling allows a holder of a valid integration credential to impersonate arbitrary users under specific conditions, exploiting an improper cryptographic signature verification flaw (CWE-347). Any actor in possession of a legitimate integration token - such as a CI/CD service account - can craft or manipulate JWT tokens to assume the identity of other users, including privileged ones, gaining their full access to repositories and administrative functions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog; however, the full C:H/I:H/A:H CVSS impact profile warrants prompt patching in environments where integration credentials are broadly distributed.
SAML response impersonation in JFrog Artifactory (all tracked versions per CPE) permits an attacker who possesses a valid SAML response to assume the identity of another user under specific conditions. Rooted in CWE-347 (Improper Verification of Cryptographic Signature), the flaw indicates Artifactory fails to adequately validate SAML assertion signatures or cryptographic bindings - a class of weakness commonly exploited via XML Signature Wrapping (XSW) or assertion replay attacks. The 'JWT Attack' tag suggests Artifactory may internally convert SAML assertions to JWT tokens, and the signature verification gap may exist at that translation layer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SAML authentication bypass in PicketLink's Service Provider signature validation allows a network-accessible attacker with low privileges to forge a SAML response and authenticate as any principal with any role on the protected application. The flaw, rooted in CWE-347 (Improper Verification of Cryptographic Signature), arises because the signature check vacuously passes when the SAML response contains zero matching assertion elements, giving the attacker full control over identity and role claims presented to the SP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact on confidentiality and integrity make this a critical authentication control failure.
Authentication bypass in Red Hat PicketLink Federation's SAML implementation lets unauthenticated remote attackers impersonate any principal in any role, because the unsolicited (IdP-initiated) response handler accepts forged SAML assertions without verifying their signature or validating their contents. Successful exploitation yields full identity spoofing, enabling information disclosure and access to restricted operations. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial-to-forge nature make this a high-priority flaw for any application relying on PicketLink SAML SSO.
Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-privileged network attackers to forge or manipulate JWT tokens, bypassing authentication and authorization controls. The vulnerability maps to CWE-347 and is tagged as a JWT attack vector capable of authentication bypass, with high confidentiality and integrity impact confirmed in the vendor's own CVSS 4.0 assessment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a meaningful risk for any organization running affected Pega Infinity deployments.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.