Jwt Attack
Monthly
TLS hostname verification is silently disabled in Netty's netty-handler module for any client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager), allowing network attackers in a man-in-the-middle position to present a valid certificate for any host and intercept supposedly encrypted traffic. Affects all Netty versions prior to 4.1.135.Final and 4.2.15.Final; no public exploit identified at time of analysis and EPSS is very low (0.04%), but the defect bypasses a core TLS protection that Netty 4.2 explicitly advertises as enabled by default.
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticated attackers to forge RPC commands as the connected administrator by bypassing signature verification in the UpdraftPlus_Remote_Communications_V2::wp_loaded handler. A flaw in how unchecked decryption return values are handled collapses the encryption key to an all-zero value, enabling arbitrary plugin upload and activation. No public exploit identified at time of analysis, but the plugin's massive WordPress install base and trivial post-bypass impact make this a high-priority patch.
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to impersonate arbitrary users by submitting their public certificate alongside a null signature to PKIAuthenticationModule.authenticate(). Successful exploitation yields privilege escalation, tampering of repository access controls, exfiltration of shared reverse-engineering databases, and persistent compromise of the Ghidra server. No public exploit identified at time of analysis, but a vendor patch and detailed advisory from VulnCheck are available.
Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in BookCars v8.3 lets remote attackers forge JWT tokens because the validateAccessToken function performs no cryptographic signature verification (CWE-347), allowing them to impersonate any user or administrator without credentials. The CVSS 9.8 rating reflects full compromise of confidentiality, integrity, and availability over the network. SSVC lists exploitation as POC with total technical impact and automatable=yes, though EPSS is very low (0.02%, 7th percentile) and it is not in CISA KEV; publicly available exploit code exists.
Signature verification bypass in Red Hat Build of Keycloak exposes OIDC authorization flows to unauthorized claim injection via JWE-encrypted request objects. When a JWE-encrypted request object is submitted and its decrypted payload is raw JSON rather than a signed JWT, Keycloak processes the claims without enforcing the configured signature policy, violating both OIDC Core and Financial-grade API (FAPI) signing requirements. An unauthenticated remote attacker can exploit this to submit forged claims into the authorization flow, achieving high integrity impact against affected deployments; no public exploit has been identified at time of analysis, and a redirect URI allowlist serves as a partial compensating control.
Denial of service in the Go golang.org/x/crypto/ssh library before version 0.52.0 allows unauthenticated remote attackers to exhaust CPU on SSH servers by submitting crafted RSA or DSA public keys with oversized parameters during public key authentication. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but the bug is trivial to trigger and the fix has been published by the Go team in CL 781641/781661.
Unauthenticated agent token theft in Coder v2 (self-hosted developer workspace platform) stems from azureidentity.Validate() verifying the PKCS#7 signer's certificate chain but skipping signature verification of the signed content itself. Remote attackers who know a target VM's vmId (a UUIDv4) can forge a PKCS#7 envelope containing a legitimate Azure certificate alongside attacker-controlled content and POST it to the unauthenticated /api/v2/workspaceagents/azure-instance-identity endpoint to receive the victim workspace agent's session token, which then unlocks Git SSH keys, OAuth tokens for GitHub/GitLab/Bitbucket, and workspace secrets. No public exploit identified at time of analysis, but the vulnerability is vendor-confirmed via GHSA-6x44-w3xg-hqqf and a detailed root-cause analysis with attack-path diagram is published.
Authentication bypass in epa4all-client allows MITM attackers positioned within the TI (Telematikinfrastruktur) network to capture SMC-B-signed authentication material by substituting a forged OIDC discovery document. The vulnerability affects all versions prior to 1.2.2 and requires the attacker to intercept TLS connections between the client and Identity Provider. No public exploit identified at time of analysis.
Authentication bypass in Palo Alto Networks PAN-OS allows unauthenticated network attackers to circumvent authentication controls when the Cloud Authentication Service (CAS) feature is enabled, with the highest risk when CAS is bound to the management interface. The flaw affects PA-Series and VM-Series firewalls as well as Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not impacted. No public exploit identified at time of analysis, and EPSS rates real-world exploitation probability low at 0.08%, but the high-value target profile and CWE-347 (Improper Verification of Cryptographic Signature) class - combined with the 'Jwt Attack' tag - warrant prompt patching.
Zen Browser's auto-update mechanism delivered unsigned code to all users due to deliberately removed MAR signature verification inherited from Firefox. The browser shipped with Mozilla's updater binary stripped of all cryptographic verification code and served update packages containing zero cryptographic signatures. Compromise of the update server or GitHub Actions pipeline allowed arbitrary code execution on all Zen installations without cryptographic chain-of-trust protection. Version 1.19.9b restores MAR signing with RSA-4096 keys and certificate verification in the updater binary.
Amazon SNS webhook spoofing in Plunk before 0.9.0 lets any unauthenticated remote attacker forge notifications to the /webhooks/sns endpoint because the server never validates the SNS signature, certificate, or topic ARN. Attackers can inject fake email-delivery events to trigger workflow automations, unsubscribe contacts, poison delivery metrics, and drive up AWS SES billing costs. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially automatable against default deployments.
Signature verification bypass in bitcoinj-core library allows attackers to forge Bitcoin transaction validations by exploiting fast-path optimization flaws in P2PKH and P2WPKH script execution. Versions 0.15 through 0.17.0 fail to verify that attacker-supplied public keys match the hash committed to in transaction outputs, enabling arbitrary keypairs to satisfy local transaction validation checks. While this does not affect SPV (Simple Payment Verification) nodes that follow proof-of-work without signature verification, applications using the correctlySpends() method for transaction validation or pre-signing checks are vulnerable to accepting fraudulent transactions. Vendor-released patch available in version 0.17.1, fixes confirmed in GitHub commits 2bc5653c and b575a682. No active exploitation confirmed (not in CISA KEV); EPSS data unavailable.
Consensus divergence in Zebra 4.3.1 enables blockchain network partitioning through crafted transparent transactions with invalid sighash types. Insufficient error handling at the Rust-to-C++ FFI boundary causes Zebra to incorrectly accept transactions with undefined hash types by reusing stale buffer data from prior valid signature checks, while zcashd correctly rejects these transactions. Attackers can exploit this by chaining OP_CHECKSIGVERIFY with OP_CHECKSIG opcodes using invalid hash types to trigger acceptance on Zebra nodes but rejection on zcashd nodes, creating a consensus split that could enable double-spend attacks. Vendor-released patch: 4.4.0. No public exploit identified at time of analysis, but the technical mechanism is fully disclosed in the GitHub advisory GHSA-gq4h-3grw-2rhv.
The Go toolchain's module proxy validation can be bypassed by attackers controlling untrusted GOPROXY or GOSUMDB endpoints, allowing delivery of malicious toolchain versions that execute with developer privileges. When the go command downloads a different toolchain version (via GOTOOLCHAIN, go.mod, or go.work directives), a malicious proxy can serve altered toolchains by exploiting checksum database validation logic that incorrectly accepts empty responses. While EPSS indicates only 1% exploitation probability and CISA SSVC marks exploitation status as 'none', the total technical impact rating and network attack vector (AV:N) represent significant supply chain risk for organizations using non-default module proxies. Vendor patch available in Go 1.26.3 and 1.25.10.
SAML signature validation in Admidio's Identity Provider implementation can be completely bypassed due to discarded return values in authentication flows. The validateSignature() method returns error strings on failure but both call sites (SSO and Single Logout handlers) discard the return value, allowing unsigned or invalidly-signed SAML requests to proceed. Attackers can forge AuthnRequests to exfiltrate logged-in users' personal data (username, email, real name, role memberships) to attacker-controlled endpoints, or forge LogoutRequests to terminate victim sessions and cascade logout across federated Service Providers. The smc_require_auth_signed configuration setting provides no protection. Public exploit code exists (PoC in GitHub advisory). CVSS 8.2 reflects network-accessible attack with no authentication required, though practical exploitation of the SSO path requires victim to have an active session. No active exploitation confirmed at time of analysis.
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWTs because VerifyHostToken in logic/jwts.go never validates the token signature. An attacker can sign a token with any arbitrary key to impersonate any host and reach host-scoped API endpoints, exposing sensitive network topology and peer information. SSVC lists a public proof-of-concept and rates the flaw automatable; EPSS is low (0.04%) and it is not on CISA KEV, so publicly available exploit code exists but no active exploitation is confirmed.
Signature duplication in AWS Tough TUF client prior to v0.22.0 allows authenticated attackers to bypass threshold signature requirements for delegated role metadata by reusing a single valid signature multiple times. The flaw undermines TUF's multi-signature integrity model, enabling acceptance of forged metadata with reduced cryptographic validation. Vendor patch available (tough-v0.22.0, tuftool-v0.15.0). No public exploit code or active exploitation confirmed at time of analysis, but CVSS 7.0 reflects high integrity impact to both vulnerable and downstream systems.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Cryptographic signature verification bypass in ASP.NET Core 10.0 enables remote unauthenticated attackers to forge authentication tokens and gain unauthorized access to protected resources. Tagged as a JWT attack involving authentication bypass, this vulnerability allows complete compromise of confidentiality and integrity without requiring any special conditions (AV:N/AC:L/PR:N/UI:N). Microsoft has released a security update addressing this flaw. No active exploitation confirmed in CISA KEV at time of analysis, though the authentication bypass nature and network-accessible attack surface present significant risk for widely deployed ASP.NET Core applications.
Signature validation bypass in Redsys payment gateway plugin (WooCommerce) allows remote attackers to mark unpaid orders as completed without actual payment. Unauthenticated attackers who obtain a valid order key and amount can forge payment callbacks across Redsys, Bizum, and Google Pay flows, enabling fraudulent order fulfillment. Affects versions ≤7.0.0 of 'Payment Gateway for Redsys & WooCommerce Lite' WordPress plugin. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation, though EPSS data unavailable. No CISA KEV listing or public POC identified at time of analysis. Vendor patch released in changeset 3501998.
Cryptographic signature bypass in Palo Alto Networks Cortex XSOAR and XSIAM Microsoft Teams integrations (versions 1.5.0 through 1.5.51) allows unauthenticated remote attackers to access and modify protected resources. The vulnerability stems from improper JWT verification (CWE-347), enabling attackers to forge authentication tokens. With CVSS 7.2 (High complexity, network-accessible, no privileges required) and tags indicating JWT attack vectors and information disclosure potential, this represents a critical integration security flaw requiring immediate patching to version 1.5.52 or later.
Signature verification bypass in wolfSSL's ECCSI implementation allows adjacent network attackers to forge cryptographic signatures for any message and identity without authentication. The wc_VerifyEccsiHash function fails to validate that signature scalars r and s fall within the required mathematical range [1, q-1], enabling attackers with knowledge of public constants to craft universally-valid forged signatures. This defeats the cryptographic integrity guarantees of ECCSI-signed data, particularly affecting JWT authentication systems and identity-based cryptographic protocols. No public exploit identified at time of analysis.
Signature verification bypass in BSV Ruby SDK versions 0.3.1 through 0.8.1 allows authenticated attackers to forge blockchain identity certificates. The WalletClient#acquire_certificate method persists certificates without validating certifier signatures in both 'direct' acquisition (where attackers supply all fields including forged signatures) and 'issuance' protocols (where malicious certifier endpoints inject invalid signatures). Forged certificates appear authentic to list_certificates and prove_certificate operations, enabling impersonation attacks. CVSS 8.1 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring low-privilege authentication. No public exploit identified at time of analysis.
LightRAG's JWT authentication can be bypassed via a hardcoded default secret 'lightrag-jwt-default-secret' when TOKEN_SECRET is not configured. Unauthenticated attackers can forge valid tokens to access protected API endpoints in installations running v1.4.10 with AUTH_ACCOUNTS enabled but TOKEN_SECRET unset. CVSS 7.5 (High) reflects network-accessible confidentiality breach with no authentication required. No public exploit identified at time of analysis, though the hardcoded secret is publicly documented in the vulnerability disclosure. EPSS data not available for this CVE.
Authentication bypass in OneUptime SAML SSO implementation allows authenticated attackers to impersonate arbitrary users by exploiting XML signature verification logic flaws. Affected versions prior to 10.0.42 decouple signature validation from identity extraction, enabling XML injection attacks where an unsigned assertion with attacker-controlled identity precedes a legitimately signed assertion. EPSS and exploitation signals indicate publicly available exploit code exists with moderate technical complexity (CVSS AC:L, PR:L). No confirmed active exploitation (not in CISA KEV).
Finite-field Diffie-Hellman (FFDH) in Mbed TLS 3.5.x, 3.6.0 through 3.6.5, and TF-PSA-Crypto 1.0 lacks contributory behavior due to improper validation of peer-supplied parameters, allowing an attacker to restrict the shared secret to a small set of predictable values. While the vulnerability does not directly impact TLS (which does not depend on contributory behavior), it poses a significant risk to protocols that do rely on this property, including those where an active network attacker or malicious peer can exploit the weakness. No CVSS score or public exploit code has been assigned at the time of analysis.
JWT token forgery in appsup-dart/jose library (versions prior to 0.3.5+1) enables remote attackers to bypass authentication by embedding attacker-controlled public keys in JOSE headers. The library incorrectly accepts header-supplied 'jwk' parameters as trusted verification keys without validating they exist in the application's trusted keystore, allowing unauthenticated attackers to sign arbitrary tokens with their own key pairs. EPSS data not available; no public exploit identified at time of analysis, though exploitation requires only standard JWT manipulation tools.
Zebra cryptocurrency nodes prior to version 4.3.0 can be forced into consensus split by malicious miners who craft blocks containing V5 transactions with matching txids but invalid authorization data. The vulnerability stems from a cache lookup that used ZIP-244 txid (which excludes authorization data) to bypass full verification, allowing nodes to accept blocks with invalid signatures. While this does not enable invalid transaction acceptance, it isolates vulnerable nodes from the Zcash network, creating fork conditions exploitable for service disruption and potential double-spend scenarios against partitioned nodes. No public exploit code or CISA KEV listing exists, but the technical complexity is low for actors with mining capabilities. Affected products are zebrad and zebra-consensus Rust packages supporting Network Upgrade 5 (V5 transactions). Vendor-released patch: Zebra 4.3.0.
Authentication bypass in OpenClaw's Feishu webhook integration (pre-2026.3.12) allows unauthenticated remote attackers to inject forged events and trigger arbitrary downstream tool execution. The vulnerability occurs when administrators configure only verificationToken without encryptKey, enabling attackers to craft malicious webhook payloads that bypass validation. No public exploit identified at time of analysis, though CVSS 8.8 reflects network accessibility (AV:N), zero complexity (AC:L), and no privileges required (PR:N).
The digitalbazaar/forge npm package accepts forged Ed25519 signatures due to missing scalar canonicalization checks, allowing authentication and authorization bypass in applications that rely on signature uniqueness. All versions since Ed25519 implementation are affected (confirmed through version 1.3.3), identified as pkg:npm/node-forge. Publicly available exploit code exists with a complete proof-of-concept demonstrating how attackers can create multiple valid signatures for the same message by adding the group order L to the scalar component S, bypassing deduplication, replay protection, and signed-object canonicalization checks. The vendor has released a patch via commit bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85.
XML Digital Signature validation in russellhaering/goxmldsig library prior to version 1.6.0 can be bypassed due to a Go loop variable capture bug, allowing remote unauthenticated attackers to forge or manipulate XML signatures without detection. The vulnerability affects applications using Go versions before 1.22 or older go.mod configurations, enabling integrity violations in SAML authentication, document signing, and other XML-DSig implementations. EPSS score of 0.02% suggests low observed exploitation probability, with no confirmed active exploitation (not in CISA KEV). Vendor patch available in version 1.6.0.
Cryptographic signature bypass in jsrsasign before 11.1.1 allows remote attackers to forge DSA signatures and X.509 certificates by supplying malicious domain parameters (g=1, y=1, r=1) that cause verification functions to incorrectly validate any message hash. This actively undermines authentication and integrity checks in applications using the library for JWT validation, certificate verification, or digital signatures. EPSS score is negligible (0.01%) despite proof-of-concept availability, and CISA SSVC classifies this as requiring proof-of-concept but not automatable, indicating targeted exploitation risk rather than widespread scanning.
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access to server-level cryptographic material to authenticate as any user and obtain elevated privileges. The vulnerability affects all ScreenConnect versions prior to 26.1 and carries a CVSS score of 9.0, indicating critical severity. While not currently listed in CISA's KEV catalog and with no public proof-of-concept available, the vulnerability's authentication bypass nature and potential for complete system compromise make it a high-priority patching target.
Private key recovery in Stanford JavaScript Crypto Library (SJCL) ECDH implementation affects all versions prior to 1.0.9, allowing remote unauthenticated attackers to extract a victim's ECDH private key by submitting crafted off-curve public keys and observing the resulting shared-secret outputs. The flaw stems from missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(), combined with dhJavaEc() returning the raw x-coordinate without hashing - providing a direct plaintext oracle. Publicly available exploit code exists (PoC gist by Kr0emer); EPSS is low at 0.02% despite the high confidentiality impact, suggesting limited current opportunistic targeting.
A critical authentication bypass vulnerability in authlib's JWT signature verification allows attackers to forge arbitrary tokens by injecting their own cryptographic keys through the JWT header. The flaw affects all versions of authlib prior to 1.6.9 when applications use key resolution callbacks that can return None (common in JWKS-based authentication flows). A working proof-of-concept exists demonstrating complete authentication bypass, enabling attackers to impersonate any user or assume administrative privileges without valid credentials.
CVE-2026-3562 is an authentication bypass vulnerability in Philips Hue Bridge's HAP (HomeKit Accessory Protocol) implementation, specifically within the ed25519_sign_open function that fails to properly verify Ed25519 cryptographic signatures. Network-adjacent attackers can exploit this flaw without authentication to execute arbitrary code on affected Hue Bridge installations. The CVSS score of 6.3 reflects moderate severity with local network access requirements, though the authentication bypass nature elevates real-world risk for smart home environments.
Authentication bypass in Authlib (Python OAuth/OpenID Connect library) versions 1.6.5 through 1.6.6 allows remote attackers to forge JWTs by supplying a token with 'alg: none' and an empty signature, which the library accepts as valid during signature verification. Because the integrity check is silently bypassed, an attacker can craft tokens with arbitrary claims and impersonate any identity. Publicly available exploit code exists (regression-test based, via the GitHub Security Advisory), but EPSS is only 0.02% (6th percentile) and the issue is not in CISA KEV - no public exploit identified as actively used at time of analysis.
JWT authentication bypass in pac4j-jwt before 4.5.9/5.7.9/6.3.3 when processing encrypted JWTs. PoC available.
Signature verification bypass in AWS-LC's PKCS7_verify() function lets unauthenticated attackers get forged PKCS#7 objects containing Authenticated Attributes accepted as validly signed, defeating the integrity guarantee the API exists to provide. It affects applications linking AWS-LC, including the Rust aws-lc-sys binding and aws_libcrypto, and is tagged as enabling JWT/authentication-bypass attacks. No public exploit identified at time of analysis and EPSS is very low (0.03%), but integrity impact is High (CVSS 4.0 8.7) and a fixed release (1.69.0) is already available.
Sap Basis versions up to 700 is affected by improper verification of cryptographic signature (CVSS 8.8).
Keycloak's invitation token validation fails to cryptographically verify JWT payload modifications, allowing authenticated attackers to alter organization IDs and email addresses to register into unauthorized organizations. This enables unauthorized access to organizations without proper authentication, affecting any Keycloak deployment using the invitation feature. No patch is currently available.
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to defeat FortiCloud SSO login by submitting a crafted SAML response, due to improper verification of the response's cryptographic signature. The flaw is confirmed actively exploited (CISA KEV), with Arctic Wolf observing malicious SSO logins in the wild, and EPSS rates it at the 93rd percentile of likelihood. Combined with a 9.8 CVSS score and CWE-347 root cause, this is a top-priority patching target for any organization running affected Fortinet management planes.
A spoofing vulnerability exists when Windows incorrectly validates file signatures. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.1%.
JWT signature verification weakness in the Cacti network monitoring framework (fixed in 1.2.31) lets an authenticated low-privilege user forge or tamper with JSON Web Tokens whose signatures are not properly validated, undermining token integrity. The CWE-347 root cause combined with the vendor's 'Jwt Attack' and 'Information Disclosure' tags points to token forgery that can bypass intended authorization checks. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; it was reported through the Alpine Linux vendor channel and patched upstream by the Cacti project.
JWT signature verification bypass in Dell Secure Connect Gateway 5.0 enables remote unauthenticated attackers to forge or tamper with cryptographically signed tokens, bypassing the product's authentication protection mechanisms. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Authenticated decryption in mirage-crypto before 2.2.0 for OCaml violates the security invariant of AEAD schemes by writing decrypted plaintext into the caller-supplied output buffer before the authentication tag is verified. When a forged tag is detected, `AES.GCM.authenticate_decrypt_into` and `Chacha20.authenticate_decrypt_into` return `false`, but the destination buffer already contains the full unverified plaintext. Applications that process buffer contents without rigidly checking the boolean return value - or where timing or compiler behavior creates subtle access windows - may consume attacker-controlled forged plaintext as if it were authenticated. No public exploit or KEV listing has been identified at time of analysis.
Improper cryptographic signature verification in OpenDDS 3.33.x's SignedDocument module allows a local, low-privileged attacker to crash the DDS participant process via a crafted signed document, causing a denial of service. The flaw (CWE-347) resides in the verify() function within the SSL/SignedDocument.cpp component of the DDS Security implementation. A proof-of-concept exists per SSVC data, though EPSS is very low at 0.15% and active exploitation has not been confirmed by CISA KEV.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Webhook signature bypass in the appwrite/templates github-issue-bot (≤ 1.1.2) allows any unauthenticated network caller to invoke the bot's comment-posting functionality without a valid GitHub HMAC signature. An inverted boolean condition in verifyWebhook causes requests lacking the X-Hub-Signature-256 header to short-circuit to success, so the body is processed as if it were a legitimate GitHub event. With attacker-controlled repository, issue, and author fields passed directly to postComment, the deployment's GITHUB_TOKEN is used to post arbitrary comments on any accessible GitHub repository and issue. No public exploit code is identified at time of analysis.
Secure boot bypass in the Ingenic T31 SoC allows an attacker with physical write access to boot media to forge SPL (Secondary Program Loader) images that pass RSA signature verification without the OEM signing key. The boot ROM's flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest - rather than validating the full cryptographic outputs - yielding a forgery success rate of approximately 2/3 per attempt. End-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X) has been confirmed by external researchers at opensensor.io; no public exploit is confirmed in CISA KEV, but a working proof-of-concept exists per the researcher disclosure.
JWT signature validation is entirely absent in Otalio Ship Property Management System before version 2.22.0, allowing any authenticated user to forge arbitrary token claims and escalate to higher privilege levels. Because the server accepts tampered JWT payloads without verifying the cryptographic signature, a low-privileged account holder can self-promote to administrator or other elevated roles by modifying their own token. Mandiant disclosed this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.
Authentication bypass in Windows Schannel allows a network-based attacker to circumvent cryptographic signature validation, achieving high-integrity impact without requiring prior privileges. Schannel, Microsoft's TLS/SSL security provider, fails to properly verify cryptographic signatures - tagged as a JWT attack vector - enabling forged or malformed tokens to pass validation and bypass security feature enforcement. No active exploitation is confirmed (SSVC: exploitation=none; not listed in CISA KEV), and the high attack complexity and required user interaction constrain opportunistic mass exploitation despite the broad Windows version footprint.
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privilege attacker to hijack another user's session by sending crafted requests that circumvent header integrity verification on certain code paths. Exploitation demands prior out-of-band observation of the target's session values, constraining this to determined, targeted attackers rather than opportunistic mass exploitation. No public exploit code and no CISA KEV listing identified at time of analysis, but successful exploitation yields full read access to the victim's session context with a high confidentiality impact per CVSS.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.
Forced logout via unsigned backchannel requests affects Red Hat Build of Keycloak when an OIDC identity provider is configured to skip signature validation. Under this non-default configuration, the backchannel logout endpoint in keycloak-services improperly accepts logout requests lacking any cryptographic signature (CWE-347), violating the OIDC backchannel logout specification. An unauthenticated network attacker who possesses knowledge of a target user's session identifiers can submit a forged unsigned logout request, terminating that session without the user's consent. No public exploit or active exploitation (CISA KEV) has been identified; with CVSS 3.7 and EPSS data absent from the input, this is a low-priority availability-only issue gated by a specific non-default configuration.
Session revocation via forged cookies in better-auth's multi-session plugin (npm, versions 1.3.34 through <1.4.0) allows any authenticated attacker to arbitrarily delete session tokens belonging to other users by supplying a crafted `_multi-*` cookie to the /sign-out after-hook, which forwards cookie values to `internalAdapter.deleteSessions()` without verifying the cryptographic signature. The flaw is not listed in the CISA KEV catalog and no public exploit code has been identified, but the low attack complexity makes unauthorized targeted session termination straightforward once an attacker holds any valid application session. Version 1.4.0 resolves the issue via patch commit cfc453a2a6eb02951f9a0a7c944064936e73eee8.
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
Arbitrary code execution in Autel MaxiCharger AC Elite Home EV chargers is possible for physically present attackers who supply a crafted, unsigned or improperly signed firmware update image to the device. The flaw (CWE-347) stems from the absence of cryptographic signature validation during the software update process - tagged as a JWT attack vector - meaning the update mechanism accepts attacker-controlled images without verifying their authenticity. No public exploit has been identified at time of analysis, and exploitation requires physical proximity, but a successful attack achieves full code execution in the device context with high confidentiality, integrity, and availability impact.
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a valid one-time password, bypassing the second authentication factor. This can lead to unauthorized access to administrator accounts if TOTP is enabled. No public exploit or active exploitation has been identified at time of analysis.
DNSSEC validation is bypassed in PowerDNS Recursor when wildcard-synthesized answers are CNAME or DNAME record types, allowing an attacker positioned to inject forged DNS responses to circumvent cryptographic integrity guarantees. Wildcard expansion proofs - the NSEC or NSEC3 records that DNSSEC uses to prove a wildcard match is legitimate - are accepted by the recursor without verifying their signatures in this specific code path. No public exploit code has been identified at time of analysis, and EPSS data was not provided; however, the bypass of DNSSEC undermines a core trust mechanism used by resolvers to reject forged DNS data.
DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Signature bypass in Janssen jans-auth-server's OIDC authorization request object processing allows unauthenticated remote attackers to submit JWE-wrapped authorization requests containing unsigned plain JSON payloads, circumventing the integrity guarantee that JAR (RFC 9101) is designed to enforce. Two distinct code defects enable the bypass: the server silently skips nested JWS validation when getSignedJWTPayload() returns null, and the forceSignedRequestObject enforcement fails to reject null-mapped algorithm identifiers such as RSA-OAEP (an encryption algorithm, not a signature algorithm). No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is fixed in version 2.0.0.
Payment bypass in the CorvusPay WooCommerce Payment Gateway plugin (all versions up to and including 2.7.4) enables unauthenticated remote attackers to fraudulently mark any pending WooCommerce order as fully paid, obtaining goods or services without actual payment. The `corvuspay_success_handler` function registers a publicly accessible REST endpoint where a cryptographic signature validation is performed but its boolean result is silently discarded - written only to a debug log - causing `$order->payment_complete()` to execute unconditionally regardless of signature validity. WooCommerce order IDs are sequential integers, making every pending order on an affected store trivially enumerable with no prior knowledge required. No public exploit code or CISA KEV listing was identified at time of analysis.
Signature forgery and denial-of-service in Libreswan's IKEv1 RSA authentication allows a remote unauthenticated attacker to impersonate an IKE peer or crash the daemon. The flaw lives in RSA_authenticate_hash_signature_raw_rsa(), which fails to validate the length of the authentication hash inside a PKCS #1 (RFC 2313) encoded SIG payload; when a peer uses a small RSA public exponent such as e=3, a Bleichenbacher-style forgery becomes feasible. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the impersonation impact against IKEv1 raw-RSA authentication makes this a high-severity issue (CVSS 8.1); remote code execution is explicitly not possible and X.509 certificate verification is unaffected.
Peer impersonation and denial-of-service in Libreswan IPsec/IKEv2 arises from improper DER/ASN.1 digest verification in RSA_authenticate_hash_signature_pkcs1_1_5_rsa() when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5 signatures. A remote unauthenticated attacker can mount a Bleichenbacher-style forgery to impersonate a peer when small RSA public exponents (e.g., e=3) are in use, or send an undersized hash to trip an assertion that aborts and restarts the daemon for sustained DoS. A vendor patch is available and there is no public exploit identified at time of analysis; RCE is not possible and X.509 certificate verification of the peer is unaffected.
Improper cryptographic signature verification in the CubeSpace CW0057 Reaction Wheel firmware (versions prior to 5.0.20) permits an attacker with physical access to flash arbitrary, unsigned firmware onto the device without any authentication. This affects a safety-critical spacecraft attitude control component used in CubeSat and small satellite missions, where unauthorized firmware replacement could cause mission-critical failures including attitude loss or uncontrolled spacecraft behavior. A proof-of-concept exploit exists (indicated by E:P in the CVSS 4.0 supplemental vector); no active exploitation has been confirmed by CISA KEV at time of analysis.
Certificate timestamp validation bypass in sigstore-java 2.0.0 allows an attacker who has already exfiltrated an ephemeral Sigstore signing key to reuse an expired Fulcio certificate, causing bundle verification to succeed when it should fail. PR #1008 erroneously removed the check that bounds a Rekor V1 log entry's `integratedTime` against the Fulcio certificate's validity window, a regression only present in the 2.0.0 release and fixed in 2.1.0. No public exploit identified at time of analysis beyond the vendor-provided proof-of-concept test bundle in sigstore-conformance; CVSS base score of 2.0 reflects the extremely narrow, high-privilege, local-only attack conditions required.
Firmware update signature bypass in Hitachi Virtual Storage Platform One Block models 23, 24, 26, and 28 allows an authenticated remote attacker to supply unvalidated firmware packages, potentially compromising storage array integrity and availability. The root cause is CWE-347 (Improper Verification of Cryptographic Signature), and the 'Jwt Attack' tag suggests the firmware validation chain relies on a JWT-based signing mechanism that can be circumvented under specific conditions. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the self-disclosure by Hitachi with a coordinated patch release indicates vendor-confirmed severity.
Signature type-binding bypass in @sigstore/core (npm) allows an attacker who controls the `payloadType` field of a DSSE envelope to substitute every ASCII character with a Unicode variant whose low byte matches, producing PAE bytes identical to a legitimate signature and causing verification to pass for a mismatched content type. All versions up to and including 3.2.0 are affected; a working proof-of-concept is included in the GitHub security advisory GHSA-jfc7-64v2-mr8c. The vulnerability is not confirmed in the CISA KEV catalog, but exploit code is publicly available, making exploitation straightforward for any attacker positioned to craft or relay DSSE envelopes.
JWT algorithm confusion in Netflix Lemur 1.9.0 allows an attacker to control which signing algorithm the server trusts by supplying an arbitrary alg value in the unverified token header, which is passed directly to pyjwt.decode() instead of a server-pinned allowlist. On current PyJWT 2.x deployments the standalone impact is limited to audit-log blinding and a durable algorithm-downgrade primitive; full account takeover requires chaining with a separate LEMUR_TOKEN_SECRET disclosure vulnerability, after which a forged HS256 admin JWT yields HTTP 200 with role=admin. A public proof-of-concept walkthrough exists (asciinema); no active exploitation is confirmed in CISA KEV.
Signer confusion in wolfSSL's PKCS7_verify implementation allows a crafted PKCS#7 message to report a trusted certificate as the signer even when an attacker-controlled certificate produced the actual signature. Any application using wolfSSL for PKCS#7 signature verification - including JWT workflows flagged in the CVE tags - may incorrectly authorize operations as if from a trusted party. No public exploit has been identified at time of analysis, but the upstream fix is available as GitHub PR #10203 and the vulnerability is straightforwardly reproducible by anyone familiar with PKCS#7 certificate bundle structure.
PKCS#12 MAC verification in wolfSSL accepts truncated or zero-length MACs because the comparison uses an attacker-controlled length field parsed from the input structure rather than the expected digest size, completely defeating HMAC integrity protection on PKCS#12 key stores. Any wolfSSL-based application that parses PKCS#12 files from untrusted sources - including certificate import endpoints, VPN provisioning services, or key management systems - can be tricked into accepting a structurally tampered PKCS#12 bundle as MAC-verified. No public exploit code or CISA KEV listing has been identified; the upstream fix is available as GitHub PR #10192 but a tagged patched release has not been independently confirmed.
HMAC tag forgery in wolfSSL's OpenSSL-compatibility layer allows a zero-length or arbitrarily truncated HMAC tag to pass verification in EVP_DigestVerifyFinal, undermining message authentication for any application relying on this API path. Applications compiled with the OPENSSL_EXTRA flag that use EVP_DigestVerifyFinal for HMAC verification - including JWT validation libraries and message authentication flows - are affected across all currently-known wolfSSL versions. The root length check only enforced that the supplied tag did not exceed the MAC size, not that it equaled it, so an attacker controlling the tag buffer or length argument could present an empty signature and bypass integrity verification. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Linked-Data Signature normalization in Mastodon's ActivityPub federation layer permits activity spoofing against servers running versions prior to 4.5.10, 4.4.17, and 4.3.23. An attacker can take a legitimately signed JSON-LD activity from a real third-party actor, re-arrange its structure, and relay it to a target Mastodon instance where it passes signature validation but is interpreted with altered semantic meaning. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the integrity impact on federated social graph trust is meaningful for operators of public-facing instances.
Signature substitution in CoreWCF's WS-Security message processing allows a remote unauthenticated attacker to replace the server's cryptographic integrity check with a signature of the attacker's choosing, effectively forging authenticated SOAP messages. Affected versions of CoreWCF.Primitives perform a document-wide lookup for ds:Signature elements rather than scoping verification to the wsse:Security header, so an attacker-injected signature in a preceding SOAP header is found and verified first. Exploitation is constrained by two non-default server-side prerequisites, limiting widespread risk on generic deployments, but the integrity bypass is complete where those conditions are met. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT signature verification (CWE-347), allowing remote attackers to forge authentication tokens without valid credentials and gain unauthorized access to protected LMS resources. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms fully unauthenticated, low-complexity network exploitation, enabling an attacker to impersonate enrolled students or instructors and read or modify course-related data. No public exploit code or active exploitation has been confirmed at time of analysis, and the vulnerability is not listed in CISA KEV.
Algorithm-confusion in Symfony's Mailomat webhook parser allows an attacker to downgrade the HMAC primitive used for signature verification, bypassing webhook authentication. Symfony packages symfony/mailomat-mailer and symfony/symfony versions 7.2.0 through 7.4.12 and 8.0.0 through 8.0.12 accept an attacker-controlled algorithm field from the inbound X-MOM-Webhook-Signature request header and pass it directly to PHP's hash_hmac(), enabling an adversary who can exploit cryptographic weaknesses in weaker HMAC primitives (e.g., HMAC-MD4 existential forgery) to inject fraudulent webhook payloads. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Signature metadata trust bypass in Apache CXF's JwsJsonContainerRequestFilter allows an attacker who can send JWS JSON-signed requests to inject unvalidated metadata - such as Content-Type or protected HTTP headers - by placing it in the first signature entry of a multi-signature JWS JSON token, even when that entry's signature was never verified. Affected deployments using the cxf-rt-rs-security-jose-jaxrs module may incorrectly trust attacker-controlled content type or header values, steering JAX-RS entity parsing or signed-header consistency checks in unintended ways. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches 4.2.2 and 4.1.7 were published June 10, 2026.
Decryption oracle exposure in Spring Security's SAML module allows unauthenticated remote attackers (PR:N, AV:N per CVSS) to submit crafted SAML Responses, LogoutRequests, and LogoutResponses to a Service Provider endpoint and leverage the SP's private key for decryption without presenting a valid XML signature. Affected deployments span Spring Security 5.7.x through 7.0.x that use SAML-based SSO or Single Logout. No public exploit has been identified at time of analysis and EPSS data was not provided, but the attack class (XML encryption oracle) is well-documented in SAML security research and carries meaningful risk in identity-sensitive environments.
Late signature validation in Siemens kas (pip/kas >= 4.8, < 5.3) allows an attacker who has already compromised a referenced upstream repository to substitute the cryptographic key used to validate that repository's tag signatures, effectively bypassing integrity checks entirely. Because kas processes and applies configuration includes from external repositories before verifying their signatures, a malicious repository can redirect the signature-validation key to one under attacker control. No public exploit code has been identified at time of analysis, and exploitation requires a highly specific multi-condition scenario including prior supply-chain access to a referenced upstream repo. Vendor-released patch version 5.3 resolves all related attack vectors.
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveKey with approximately 30-40 crafted public key values lying off the target elliptic curve. Because the implementation omits point validation - failing to verify that (X, Y) satisfies Y^2 ≡ X^3 + aX + b mod P for the specified curve - each malformed call leaks a residue d mod r, where d is the private key and r is the order of the attacker-chosen invalid curve. Accumulated residues allow full private key reconstruction via the Chinese Remainder Theorem. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the underlying invalid curve attack technique is well-documented in cryptographic literature and reproducible by any skilled attacker with local access.
Cookie context confusion in Django's signed cookie implementation allows a remote low-privileged attacker to substitute a cookie signed in one application context into a different context where a distinct (name, salt) pair produces the same concatenated string. Affected are Django 6.0 before 6.0.6 and Django 5.2 before 5.2.15; older unsupported series (5.0.x, 4.1.x, 3.2.x) were not evaluated but may also be affected. The real-world impact is limited to low-confidence data exposure (VC:L), with no public exploit identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects a low-severity, contextually constrained flaw.
Integrity bypass in Siemens kas (pip/kas < 5.3) allows an attacker who controls a referenced external git repository to substitute arbitrary commit content by creating a branch whose name matches the commit SHA recorded in a kas configuration file. Because kas passed the raw SHA string to `git checkout` without forcing disambiguation to a commit object, git resolves a branch of that name instead of the pinned commit, defeating the integrity guarantee users rely on. The primary impact falls on SHA-256 commit IDs; SHA-1 commits face a related but distinct risk through hash-collision substitution. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Algorithm allow-list bypass in PyJWT 2.9.0-2.12.1 permits an attacker who controls a registered JWK/JWKS private key to circumvent caller-enforced algorithm restrictions during JWT signature verification. The library correctly checks the token header's alg claim against the caller-supplied allow-list, but then performs the actual cryptographic verification using the algorithm bound to the PyJWK object rather than the header-declared algorithm - creating a exploitable mismatch. Specifically, the documented PyJWKClient.get_signing_key_from_jwt() flow is affected, meaning applications relying on this pattern for algorithm-restricted JWT validation may accept tokens signed with algorithms they explicitly prohibited. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
TLS hostname verification is silently disabled in Netty's netty-handler module for any client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager), allowing network attackers in a man-in-the-middle position to present a valid certificate for any host and intercept supposedly encrypted traffic. Affects all Netty versions prior to 4.1.135.Final and 4.2.15.Final; no public exploit identified at time of analysis and EPSS is very low (0.04%), but the defect bypasses a core TLS protection that Netty 4.2 explicitly advertises as enabled by default.
Authentication bypass in Cloud Foundry UAA (User Account and Authentication) versions 2.0.0 through 78.13.0 allows remote attackers to forge SAML assertions and impersonate users by exploiting a logic flaw where XML encryption was accepted as a substitute for XML signature verification. Because the Service Provider's public encryption key is published in SAML metadata, any party - not just a trusted Identity Provider - can craft encrypted-but-unsigned assertions that UAA will decrypt and trust, breaking the identity-assurance guarantee of SAML. No public exploit identified at time of analysis, but the cryptographic confusion (CWE-347) is well-understood and the impact (full identity spoofing into the platform IAM) is severe.
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticated attackers to forge RPC commands as the connected administrator by bypassing signature verification in the UpdraftPlus_Remote_Communications_V2::wp_loaded handler. A flaw in how unchecked decryption return values are handled collapses the encryption key to an all-zero value, enabling arbitrary plugin upload and activation. No public exploit identified at time of analysis, but the plugin's massive WordPress install base and trivial post-bypass impact make this a high-priority patch.
Authentication bypass in NSA Ghidra versions prior to 12.1 allows any holder of a valid CA-signed certificate to impersonate arbitrary users by submitting their public certificate alongside a null signature to PKIAuthenticationModule.authenticate(). Successful exploitation yields privilege escalation, tampering of repository access controls, exfiltration of shared reverse-engineering databases, and persistent compromise of the Ghidra server. No public exploit identified at time of analysis, but a vendor patch and detailed advisory from VulnCheck are available.
Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in BookCars v8.3 lets remote attackers forge JWT tokens because the validateAccessToken function performs no cryptographic signature verification (CWE-347), allowing them to impersonate any user or administrator without credentials. The CVSS 9.8 rating reflects full compromise of confidentiality, integrity, and availability over the network. SSVC lists exploitation as POC with total technical impact and automatable=yes, though EPSS is very low (0.02%, 7th percentile) and it is not in CISA KEV; publicly available exploit code exists.
Signature verification bypass in Red Hat Build of Keycloak exposes OIDC authorization flows to unauthorized claim injection via JWE-encrypted request objects. When a JWE-encrypted request object is submitted and its decrypted payload is raw JSON rather than a signed JWT, Keycloak processes the claims without enforcing the configured signature policy, violating both OIDC Core and Financial-grade API (FAPI) signing requirements. An unauthenticated remote attacker can exploit this to submit forged claims into the authorization flow, achieving high integrity impact against affected deployments; no public exploit has been identified at time of analysis, and a redirect URI allowlist serves as a partial compensating control.
Denial of service in the Go golang.org/x/crypto/ssh library before version 0.52.0 allows unauthenticated remote attackers to exhaust CPU on SSH servers by submitting crafted RSA or DSA public keys with oversized parameters during public key authentication. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but the bug is trivial to trigger and the fix has been published by the Go team in CL 781641/781661.
Unauthenticated agent token theft in Coder v2 (self-hosted developer workspace platform) stems from azureidentity.Validate() verifying the PKCS#7 signer's certificate chain but skipping signature verification of the signed content itself. Remote attackers who know a target VM's vmId (a UUIDv4) can forge a PKCS#7 envelope containing a legitimate Azure certificate alongside attacker-controlled content and POST it to the unauthenticated /api/v2/workspaceagents/azure-instance-identity endpoint to receive the victim workspace agent's session token, which then unlocks Git SSH keys, OAuth tokens for GitHub/GitLab/Bitbucket, and workspace secrets. No public exploit identified at time of analysis, but the vulnerability is vendor-confirmed via GHSA-6x44-w3xg-hqqf and a detailed root-cause analysis with attack-path diagram is published.
Authentication bypass in epa4all-client allows MITM attackers positioned within the TI (Telematikinfrastruktur) network to capture SMC-B-signed authentication material by substituting a forged OIDC discovery document. The vulnerability affects all versions prior to 1.2.2 and requires the attacker to intercept TLS connections between the client and Identity Provider. No public exploit identified at time of analysis.
Authentication bypass in Palo Alto Networks PAN-OS allows unauthenticated network attackers to circumvent authentication controls when the Cloud Authentication Service (CAS) feature is enabled, with the highest risk when CAS is bound to the management interface. The flaw affects PA-Series and VM-Series firewalls as well as Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not impacted. No public exploit identified at time of analysis, and EPSS rates real-world exploitation probability low at 0.08%, but the high-value target profile and CWE-347 (Improper Verification of Cryptographic Signature) class - combined with the 'Jwt Attack' tag - warrant prompt patching.
Zen Browser's auto-update mechanism delivered unsigned code to all users due to deliberately removed MAR signature verification inherited from Firefox. The browser shipped with Mozilla's updater binary stripped of all cryptographic verification code and served update packages containing zero cryptographic signatures. Compromise of the update server or GitHub Actions pipeline allowed arbitrary code execution on all Zen installations without cryptographic chain-of-trust protection. Version 1.19.9b restores MAR signing with RSA-4096 keys and certificate verification in the updater binary.
Amazon SNS webhook spoofing in Plunk before 0.9.0 lets any unauthenticated remote attacker forge notifications to the /webhooks/sns endpoint because the server never validates the SNS signature, certificate, or topic ARN. Attackers can inject fake email-delivery events to trigger workflow automations, unsubscribe contacts, poison delivery metrics, and drive up AWS SES billing costs. No public exploit identified at time of analysis and EPSS is very low (0.03%), but the flaw is trivially automatable against default deployments.
Signature verification bypass in bitcoinj-core library allows attackers to forge Bitcoin transaction validations by exploiting fast-path optimization flaws in P2PKH and P2WPKH script execution. Versions 0.15 through 0.17.0 fail to verify that attacker-supplied public keys match the hash committed to in transaction outputs, enabling arbitrary keypairs to satisfy local transaction validation checks. While this does not affect SPV (Simple Payment Verification) nodes that follow proof-of-work without signature verification, applications using the correctlySpends() method for transaction validation or pre-signing checks are vulnerable to accepting fraudulent transactions. Vendor-released patch available in version 0.17.1, fixes confirmed in GitHub commits 2bc5653c and b575a682. No active exploitation confirmed (not in CISA KEV); EPSS data unavailable.
Consensus divergence in Zebra 4.3.1 enables blockchain network partitioning through crafted transparent transactions with invalid sighash types. Insufficient error handling at the Rust-to-C++ FFI boundary causes Zebra to incorrectly accept transactions with undefined hash types by reusing stale buffer data from prior valid signature checks, while zcashd correctly rejects these transactions. Attackers can exploit this by chaining OP_CHECKSIGVERIFY with OP_CHECKSIG opcodes using invalid hash types to trigger acceptance on Zebra nodes but rejection on zcashd nodes, creating a consensus split that could enable double-spend attacks. Vendor-released patch: 4.4.0. No public exploit identified at time of analysis, but the technical mechanism is fully disclosed in the GitHub advisory GHSA-gq4h-3grw-2rhv.
The Go toolchain's module proxy validation can be bypassed by attackers controlling untrusted GOPROXY or GOSUMDB endpoints, allowing delivery of malicious toolchain versions that execute with developer privileges. When the go command downloads a different toolchain version (via GOTOOLCHAIN, go.mod, or go.work directives), a malicious proxy can serve altered toolchains by exploiting checksum database validation logic that incorrectly accepts empty responses. While EPSS indicates only 1% exploitation probability and CISA SSVC marks exploitation status as 'none', the total technical impact rating and network attack vector (AV:N) represent significant supply chain risk for organizations using non-default module proxies. Vendor patch available in Go 1.26.3 and 1.25.10.
SAML signature validation in Admidio's Identity Provider implementation can be completely bypassed due to discarded return values in authentication flows. The validateSignature() method returns error strings on failure but both call sites (SSO and Single Logout handlers) discard the return value, allowing unsigned or invalidly-signed SAML requests to proceed. Attackers can forge AuthnRequests to exfiltrate logged-in users' personal data (username, email, real name, role memberships) to attacker-controlled endpoints, or forge LogoutRequests to terminate victim sessions and cascade logout across federated Service Providers. The smc_require_auth_signed configuration setting provides no protection. Public exploit code exists (PoC in GitHub advisory). CVSS 8.2 reflects network-accessible attack with no authentication required, though practical exploitation of the SSO path requires victim to have an active session. No active exploitation confirmed at time of analysis.
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWTs because VerifyHostToken in logic/jwts.go never validates the token signature. An attacker can sign a token with any arbitrary key to impersonate any host and reach host-scoped API endpoints, exposing sensitive network topology and peer information. SSVC lists a public proof-of-concept and rates the flaw automatable; EPSS is low (0.04%) and it is not on CISA KEV, so publicly available exploit code exists but no active exploitation is confirmed.
Signature duplication in AWS Tough TUF client prior to v0.22.0 allows authenticated attackers to bypass threshold signature requirements for delegated role metadata by reusing a single valid signature multiple times. The flaw undermines TUF's multi-signature integrity model, enabling acceptance of forged metadata with reduced cryptographic validation. Vendor patch available (tough-v0.22.0, tuftool-v0.15.0). No public exploit code or active exploitation confirmed at time of analysis, but CVSS 7.0 reflects high integrity impact to both vulnerable and downstream systems.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Cryptographic signature verification bypass in ASP.NET Core 10.0 enables remote unauthenticated attackers to forge authentication tokens and gain unauthorized access to protected resources. Tagged as a JWT attack involving authentication bypass, this vulnerability allows complete compromise of confidentiality and integrity without requiring any special conditions (AV:N/AC:L/PR:N/UI:N). Microsoft has released a security update addressing this flaw. No active exploitation confirmed in CISA KEV at time of analysis, though the authentication bypass nature and network-accessible attack surface present significant risk for widely deployed ASP.NET Core applications.
Signature validation bypass in Redsys payment gateway plugin (WooCommerce) allows remote attackers to mark unpaid orders as completed without actual payment. Unauthenticated attackers who obtain a valid order key and amount can forge payment callbacks across Redsys, Bizum, and Google Pay flows, enabling fraudulent order fulfillment. Affects versions ≤7.0.0 of 'Payment Gateway for Redsys & WooCommerce Lite' WordPress plugin. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation, though EPSS data unavailable. No CISA KEV listing or public POC identified at time of analysis. Vendor patch released in changeset 3501998.
Cryptographic signature bypass in Palo Alto Networks Cortex XSOAR and XSIAM Microsoft Teams integrations (versions 1.5.0 through 1.5.51) allows unauthenticated remote attackers to access and modify protected resources. The vulnerability stems from improper JWT verification (CWE-347), enabling attackers to forge authentication tokens. With CVSS 7.2 (High complexity, network-accessible, no privileges required) and tags indicating JWT attack vectors and information disclosure potential, this represents a critical integration security flaw requiring immediate patching to version 1.5.52 or later.
Signature verification bypass in wolfSSL's ECCSI implementation allows adjacent network attackers to forge cryptographic signatures for any message and identity without authentication. The wc_VerifyEccsiHash function fails to validate that signature scalars r and s fall within the required mathematical range [1, q-1], enabling attackers with knowledge of public constants to craft universally-valid forged signatures. This defeats the cryptographic integrity guarantees of ECCSI-signed data, particularly affecting JWT authentication systems and identity-based cryptographic protocols. No public exploit identified at time of analysis.
Signature verification bypass in BSV Ruby SDK versions 0.3.1 through 0.8.1 allows authenticated attackers to forge blockchain identity certificates. The WalletClient#acquire_certificate method persists certificates without validating certifier signatures in both 'direct' acquisition (where attackers supply all fields including forged signatures) and 'issuance' protocols (where malicious certifier endpoints inject invalid signatures). Forged certificates appear authentic to list_certificates and prove_certificate operations, enabling impersonation attacks. CVSS 8.1 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring low-privilege authentication. No public exploit identified at time of analysis.
LightRAG's JWT authentication can be bypassed via a hardcoded default secret 'lightrag-jwt-default-secret' when TOKEN_SECRET is not configured. Unauthenticated attackers can forge valid tokens to access protected API endpoints in installations running v1.4.10 with AUTH_ACCOUNTS enabled but TOKEN_SECRET unset. CVSS 7.5 (High) reflects network-accessible confidentiality breach with no authentication required. No public exploit identified at time of analysis, though the hardcoded secret is publicly documented in the vulnerability disclosure. EPSS data not available for this CVE.
Authentication bypass in OneUptime SAML SSO implementation allows authenticated attackers to impersonate arbitrary users by exploiting XML signature verification logic flaws. Affected versions prior to 10.0.42 decouple signature validation from identity extraction, enabling XML injection attacks where an unsigned assertion with attacker-controlled identity precedes a legitimately signed assertion. EPSS and exploitation signals indicate publicly available exploit code exists with moderate technical complexity (CVSS AC:L, PR:L). No confirmed active exploitation (not in CISA KEV).
Finite-field Diffie-Hellman (FFDH) in Mbed TLS 3.5.x, 3.6.0 through 3.6.5, and TF-PSA-Crypto 1.0 lacks contributory behavior due to improper validation of peer-supplied parameters, allowing an attacker to restrict the shared secret to a small set of predictable values. While the vulnerability does not directly impact TLS (which does not depend on contributory behavior), it poses a significant risk to protocols that do rely on this property, including those where an active network attacker or malicious peer can exploit the weakness. No CVSS score or public exploit code has been assigned at the time of analysis.
JWT token forgery in appsup-dart/jose library (versions prior to 0.3.5+1) enables remote attackers to bypass authentication by embedding attacker-controlled public keys in JOSE headers. The library incorrectly accepts header-supplied 'jwk' parameters as trusted verification keys without validating they exist in the application's trusted keystore, allowing unauthenticated attackers to sign arbitrary tokens with their own key pairs. EPSS data not available; no public exploit identified at time of analysis, though exploitation requires only standard JWT manipulation tools.
Zebra cryptocurrency nodes prior to version 4.3.0 can be forced into consensus split by malicious miners who craft blocks containing V5 transactions with matching txids but invalid authorization data. The vulnerability stems from a cache lookup that used ZIP-244 txid (which excludes authorization data) to bypass full verification, allowing nodes to accept blocks with invalid signatures. While this does not enable invalid transaction acceptance, it isolates vulnerable nodes from the Zcash network, creating fork conditions exploitable for service disruption and potential double-spend scenarios against partitioned nodes. No public exploit code or CISA KEV listing exists, but the technical complexity is low for actors with mining capabilities. Affected products are zebrad and zebra-consensus Rust packages supporting Network Upgrade 5 (V5 transactions). Vendor-released patch: Zebra 4.3.0.
Authentication bypass in OpenClaw's Feishu webhook integration (pre-2026.3.12) allows unauthenticated remote attackers to inject forged events and trigger arbitrary downstream tool execution. The vulnerability occurs when administrators configure only verificationToken without encryptKey, enabling attackers to craft malicious webhook payloads that bypass validation. No public exploit identified at time of analysis, though CVSS 8.8 reflects network accessibility (AV:N), zero complexity (AC:L), and no privileges required (PR:N).
The digitalbazaar/forge npm package accepts forged Ed25519 signatures due to missing scalar canonicalization checks, allowing authentication and authorization bypass in applications that rely on signature uniqueness. All versions since Ed25519 implementation are affected (confirmed through version 1.3.3), identified as pkg:npm/node-forge. Publicly available exploit code exists with a complete proof-of-concept demonstrating how attackers can create multiple valid signatures for the same message by adding the group order L to the scalar component S, bypassing deduplication, replay protection, and signed-object canonicalization checks. The vendor has released a patch via commit bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85.
XML Digital Signature validation in russellhaering/goxmldsig library prior to version 1.6.0 can be bypassed due to a Go loop variable capture bug, allowing remote unauthenticated attackers to forge or manipulate XML signatures without detection. The vulnerability affects applications using Go versions before 1.22 or older go.mod configurations, enabling integrity violations in SAML authentication, document signing, and other XML-DSig implementations. EPSS score of 0.02% suggests low observed exploitation probability, with no confirmed active exploitation (not in CISA KEV). Vendor patch available in version 1.6.0.
Cryptographic signature bypass in jsrsasign before 11.1.1 allows remote attackers to forge DSA signatures and X.509 certificates by supplying malicious domain parameters (g=1, y=1, r=1) that cause verification functions to incorrectly validate any message hash. This actively undermines authentication and integrity checks in applications using the library for JWT validation, certificate verification, or digital signatures. EPSS score is negligible (0.01%) despite proof-of-concept availability, and CISA SSVC classifies this as requiring proof-of-concept but not automatable, indicating targeted exploitation risk rather than widespread scanning.
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access to server-level cryptographic material to authenticate as any user and obtain elevated privileges. The vulnerability affects all ScreenConnect versions prior to 26.1 and carries a CVSS score of 9.0, indicating critical severity. While not currently listed in CISA's KEV catalog and with no public proof-of-concept available, the vulnerability's authentication bypass nature and potential for complete system compromise make it a high-priority patching target.
Private key recovery in Stanford JavaScript Crypto Library (SJCL) ECDH implementation affects all versions prior to 1.0.9, allowing remote unauthenticated attackers to extract a victim's ECDH private key by submitting crafted off-curve public keys and observing the resulting shared-secret outputs. The flaw stems from missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(), combined with dhJavaEc() returning the raw x-coordinate without hashing - providing a direct plaintext oracle. Publicly available exploit code exists (PoC gist by Kr0emer); EPSS is low at 0.02% despite the high confidentiality impact, suggesting limited current opportunistic targeting.
A critical authentication bypass vulnerability in authlib's JWT signature verification allows attackers to forge arbitrary tokens by injecting their own cryptographic keys through the JWT header. The flaw affects all versions of authlib prior to 1.6.9 when applications use key resolution callbacks that can return None (common in JWKS-based authentication flows). A working proof-of-concept exists demonstrating complete authentication bypass, enabling attackers to impersonate any user or assume administrative privileges without valid credentials.
CVE-2026-3562 is an authentication bypass vulnerability in Philips Hue Bridge's HAP (HomeKit Accessory Protocol) implementation, specifically within the ed25519_sign_open function that fails to properly verify Ed25519 cryptographic signatures. Network-adjacent attackers can exploit this flaw without authentication to execute arbitrary code on affected Hue Bridge installations. The CVSS score of 6.3 reflects moderate severity with local network access requirements, though the authentication bypass nature elevates real-world risk for smart home environments.
Authentication bypass in Authlib (Python OAuth/OpenID Connect library) versions 1.6.5 through 1.6.6 allows remote attackers to forge JWTs by supplying a token with 'alg: none' and an empty signature, which the library accepts as valid during signature verification. Because the integrity check is silently bypassed, an attacker can craft tokens with arbitrary claims and impersonate any identity. Publicly available exploit code exists (regression-test based, via the GitHub Security Advisory), but EPSS is only 0.02% (6th percentile) and the issue is not in CISA KEV - no public exploit identified as actively used at time of analysis.
JWT authentication bypass in pac4j-jwt before 4.5.9/5.7.9/6.3.3 when processing encrypted JWTs. PoC available.
Signature verification bypass in AWS-LC's PKCS7_verify() function lets unauthenticated attackers get forged PKCS#7 objects containing Authenticated Attributes accepted as validly signed, defeating the integrity guarantee the API exists to provide. It affects applications linking AWS-LC, including the Rust aws-lc-sys binding and aws_libcrypto, and is tagged as enabling JWT/authentication-bypass attacks. No public exploit identified at time of analysis and EPSS is very low (0.03%), but integrity impact is High (CVSS 4.0 8.7) and a fixed release (1.69.0) is already available.
Sap Basis versions up to 700 is affected by improper verification of cryptographic signature (CVSS 8.8).
Keycloak's invitation token validation fails to cryptographically verify JWT payload modifications, allowing authenticated attackers to alter organization IDs and email addresses to register into unauthorized organizations. This enables unauthorized access to organizations without proper authentication, affecting any Keycloak deployment using the invitation feature. No patch is currently available.
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to defeat FortiCloud SSO login by submitting a crafted SAML response, due to improper verification of the response's cryptographic signature. The flaw is confirmed actively exploited (CISA KEV), with Arctic Wolf observing malicious SSO logins in the wild, and EPSS rates it at the 93rd percentile of likelihood. Combined with a 9.8 CVSS score and CWE-347 root cause, this is a top-priority patching target for any organization running affected Fortinet management planes.
A spoofing vulnerability exists when Windows incorrectly validates file signatures. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 78.1%.
JWT signature verification weakness in the Cacti network monitoring framework (fixed in 1.2.31) lets an authenticated low-privilege user forge or tamper with JSON Web Tokens whose signatures are not properly validated, undermining token integrity. The CWE-347 root cause combined with the vendor's 'Jwt Attack' and 'Information Disclosure' tags points to token forgery that can bypass intended authorization checks. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; it was reported through the Alpine Linux vendor channel and patched upstream by the Cacti project.
JWT signature verification bypass in Dell Secure Connect Gateway 5.0 enables remote unauthenticated attackers to forge or tamper with cryptographically signed tokens, bypassing the product's authentication protection mechanisms. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Authenticated decryption in mirage-crypto before 2.2.0 for OCaml violates the security invariant of AEAD schemes by writing decrypted plaintext into the caller-supplied output buffer before the authentication tag is verified. When a forged tag is detected, `AES.GCM.authenticate_decrypt_into` and `Chacha20.authenticate_decrypt_into` return `false`, but the destination buffer already contains the full unverified plaintext. Applications that process buffer contents without rigidly checking the boolean return value - or where timing or compiler behavior creates subtle access windows - may consume attacker-controlled forged plaintext as if it were authenticated. No public exploit or KEV listing has been identified at time of analysis.
Improper cryptographic signature verification in OpenDDS 3.33.x's SignedDocument module allows a local, low-privileged attacker to crash the DDS participant process via a crafted signed document, causing a denial of service. The flaw (CWE-347) resides in the verify() function within the SSL/SignedDocument.cpp component of the DDS Security implementation. A proof-of-concept exists per SSVC data, though EPSS is very low at 0.15% and active exploitation has not been confirmed by CISA KEV.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Webhook signature bypass in the appwrite/templates github-issue-bot (≤ 1.1.2) allows any unauthenticated network caller to invoke the bot's comment-posting functionality without a valid GitHub HMAC signature. An inverted boolean condition in verifyWebhook causes requests lacking the X-Hub-Signature-256 header to short-circuit to success, so the body is processed as if it were a legitimate GitHub event. With attacker-controlled repository, issue, and author fields passed directly to postComment, the deployment's GITHUB_TOKEN is used to post arbitrary comments on any accessible GitHub repository and issue. No public exploit code is identified at time of analysis.
Secure boot bypass in the Ingenic T31 SoC allows an attacker with physical write access to boot media to forge SPL (Secondary Program Loader) images that pass RSA signature verification without the OEM signing key. The boot ROM's flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest - rather than validating the full cryptographic outputs - yielding a forgery success rate of approximately 2/3 per attempt. End-to-end hardware acceptance of a forged firmware image on a Wyze Video Doorbell v2 (T31X) has been confirmed by external researchers at opensensor.io; no public exploit is confirmed in CISA KEV, but a working proof-of-concept exists per the researcher disclosure.
JWT signature validation is entirely absent in Otalio Ship Property Management System before version 2.22.0, allowing any authenticated user to forge arbitrary token claims and escalate to higher privilege levels. Because the server accepts tampered JWT payloads without verifying the cryptographic signature, a low-privileged account holder can self-promote to administrator or other elevated roles by modifying their own token. Mandiant disclosed this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Integrity-check bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets an attacker defeat the product's file-integrity verification: when a LUKS-encrypted volume is present, the software fails to validate that encryption correctly and then silently skips ALL CryptoPro integrity checks, so tampered files pass as trusted. This undermines the pre-boot/endpoint trust guarantees the product exists to provide, enabling evil-maid-style tampering. There is no public exploit identified at time of analysis, though the flaw is the subject of a Black Hat USA 2026 disclosure ('The Cost of Obscurity'); EPSS is very low (0.11%, 1st percentile) and it is not on CISA KEV.
Authentication bypass in Windows Schannel allows a network-based attacker to circumvent cryptographic signature validation, achieving high-integrity impact without requiring prior privileges. Schannel, Microsoft's TLS/SSL security provider, fails to properly verify cryptographic signatures - tagged as a JWT attack vector - enabling forged or malformed tokens to pass validation and bypass security feature enforcement. No active exploitation is confirmed (SSVC: exploitation=none; not listed in CISA KEV), and the high attack complexity and required user interaction constrain opportunistic mass exploitation despite the broad Windows version footprint.
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privilege attacker to hijack another user's session by sending crafted requests that circumvent header integrity verification on certain code paths. Exploitation demands prior out-of-band observation of the target's session values, constraining this to determined, targeted attackers rather than opportunistic mass exploitation. No public exploit code and no CISA KEV listing identified at time of analysis, but successful exploitation yields full read access to the victim's session context with a high confidentiality impact per CVSS.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.
Forced logout via unsigned backchannel requests affects Red Hat Build of Keycloak when an OIDC identity provider is configured to skip signature validation. Under this non-default configuration, the backchannel logout endpoint in keycloak-services improperly accepts logout requests lacking any cryptographic signature (CWE-347), violating the OIDC backchannel logout specification. An unauthenticated network attacker who possesses knowledge of a target user's session identifiers can submit a forged unsigned logout request, terminating that session without the user's consent. No public exploit or active exploitation (CISA KEV) has been identified; with CVSS 3.7 and EPSS data absent from the input, this is a low-priority availability-only issue gated by a specific non-default configuration.
Session revocation via forged cookies in better-auth's multi-session plugin (npm, versions 1.3.34 through <1.4.0) allows any authenticated attacker to arbitrarily delete session tokens belonging to other users by supplying a crafted `_multi-*` cookie to the /sign-out after-hook, which forwards cookie values to `internalAdapter.deleteSessions()` without verifying the cryptographic signature. The flaw is not listed in the CISA KEV catalog and no public exploit code has been identified, but the low attack complexity makes unauthorized targeted session termination straightforward once an attacker holds any valid application session. Version 1.4.0 resolves the issue via patch commit cfc453a2a6eb02951f9a0a7c944064936e73eee8.
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
Arbitrary code execution in Autel MaxiCharger AC Elite Home EV chargers is possible for physically present attackers who supply a crafted, unsigned or improperly signed firmware update image to the device. The flaw (CWE-347) stems from the absence of cryptographic signature validation during the software update process - tagged as a JWT attack vector - meaning the update mechanism accepts attacker-controlled images without verifying their authenticity. No public exploit has been identified at time of analysis, and exploitation requires physical proximity, but a successful attack achieves full code execution in the device context with high confidentiality, integrity, and availability impact.
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a valid one-time password, bypassing the second authentication factor. This can lead to unauthorized access to administrator accounts if TOTP is enabled. No public exploit or active exploitation has been identified at time of analysis.
DNSSEC validation is bypassed in PowerDNS Recursor when wildcard-synthesized answers are CNAME or DNAME record types, allowing an attacker positioned to inject forged DNS responses to circumvent cryptographic integrity guarantees. Wildcard expansion proofs - the NSEC or NSEC3 records that DNSSEC uses to prove a wildcard match is legitimate - are accepted by the recursor without verifying their signatures in this specific code path. No public exploit code has been identified at time of analysis, and EPSS data was not provided; however, the bypass of DNSSEC undermines a core trust mechanism used by resolvers to reject forged DNS data.
DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Signature bypass in Janssen jans-auth-server's OIDC authorization request object processing allows unauthenticated remote attackers to submit JWE-wrapped authorization requests containing unsigned plain JSON payloads, circumventing the integrity guarantee that JAR (RFC 9101) is designed to enforce. Two distinct code defects enable the bypass: the server silently skips nested JWS validation when getSignedJWTPayload() returns null, and the forceSignedRequestObject enforcement fails to reject null-mapped algorithm identifiers such as RSA-OAEP (an encryption algorithm, not a signature algorithm). No public exploit code has been identified and the vulnerability is not listed in CISA KEV; it is fixed in version 2.0.0.
Payment bypass in the CorvusPay WooCommerce Payment Gateway plugin (all versions up to and including 2.7.4) enables unauthenticated remote attackers to fraudulently mark any pending WooCommerce order as fully paid, obtaining goods or services without actual payment. The `corvuspay_success_handler` function registers a publicly accessible REST endpoint where a cryptographic signature validation is performed but its boolean result is silently discarded - written only to a debug log - causing `$order->payment_complete()` to execute unconditionally regardless of signature validity. WooCommerce order IDs are sequential integers, making every pending order on an affected store trivially enumerable with no prior knowledge required. No public exploit code or CISA KEV listing was identified at time of analysis.
Signature forgery and denial-of-service in Libreswan's IKEv1 RSA authentication allows a remote unauthenticated attacker to impersonate an IKE peer or crash the daemon. The flaw lives in RSA_authenticate_hash_signature_raw_rsa(), which fails to validate the length of the authentication hash inside a PKCS #1 (RFC 2313) encoded SIG payload; when a peer uses a small RSA public exponent such as e=3, a Bleichenbacher-style forgery becomes feasible. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the impersonation impact against IKEv1 raw-RSA authentication makes this a high-severity issue (CVSS 8.1); remote code execution is explicitly not possible and X.509 certificate verification is unaffected.
Peer impersonation and denial-of-service in Libreswan IPsec/IKEv2 arises from improper DER/ASN.1 digest verification in RSA_authenticate_hash_signature_pkcs1_1_5_rsa() when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5 signatures. A remote unauthenticated attacker can mount a Bleichenbacher-style forgery to impersonate a peer when small RSA public exponents (e.g., e=3) are in use, or send an undersized hash to trip an assertion that aborts and restarts the daemon for sustained DoS. A vendor patch is available and there is no public exploit identified at time of analysis; RCE is not possible and X.509 certificate verification of the peer is unaffected.
Improper cryptographic signature verification in the CubeSpace CW0057 Reaction Wheel firmware (versions prior to 5.0.20) permits an attacker with physical access to flash arbitrary, unsigned firmware onto the device without any authentication. This affects a safety-critical spacecraft attitude control component used in CubeSat and small satellite missions, where unauthorized firmware replacement could cause mission-critical failures including attitude loss or uncontrolled spacecraft behavior. A proof-of-concept exploit exists (indicated by E:P in the CVSS 4.0 supplemental vector); no active exploitation has been confirmed by CISA KEV at time of analysis.
Certificate timestamp validation bypass in sigstore-java 2.0.0 allows an attacker who has already exfiltrated an ephemeral Sigstore signing key to reuse an expired Fulcio certificate, causing bundle verification to succeed when it should fail. PR #1008 erroneously removed the check that bounds a Rekor V1 log entry's `integratedTime` against the Fulcio certificate's validity window, a regression only present in the 2.0.0 release and fixed in 2.1.0. No public exploit identified at time of analysis beyond the vendor-provided proof-of-concept test bundle in sigstore-conformance; CVSS base score of 2.0 reflects the extremely narrow, high-privilege, local-only attack conditions required.
Firmware update signature bypass in Hitachi Virtual Storage Platform One Block models 23, 24, 26, and 28 allows an authenticated remote attacker to supply unvalidated firmware packages, potentially compromising storage array integrity and availability. The root cause is CWE-347 (Improper Verification of Cryptographic Signature), and the 'Jwt Attack' tag suggests the firmware validation chain relies on a JWT-based signing mechanism that can be circumvented under specific conditions. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the self-disclosure by Hitachi with a coordinated patch release indicates vendor-confirmed severity.
Signature type-binding bypass in @sigstore/core (npm) allows an attacker who controls the `payloadType` field of a DSSE envelope to substitute every ASCII character with a Unicode variant whose low byte matches, producing PAE bytes identical to a legitimate signature and causing verification to pass for a mismatched content type. All versions up to and including 3.2.0 are affected; a working proof-of-concept is included in the GitHub security advisory GHSA-jfc7-64v2-mr8c. The vulnerability is not confirmed in the CISA KEV catalog, but exploit code is publicly available, making exploitation straightforward for any attacker positioned to craft or relay DSSE envelopes.
JWT algorithm confusion in Netflix Lemur 1.9.0 allows an attacker to control which signing algorithm the server trusts by supplying an arbitrary alg value in the unverified token header, which is passed directly to pyjwt.decode() instead of a server-pinned allowlist. On current PyJWT 2.x deployments the standalone impact is limited to audit-log blinding and a durable algorithm-downgrade primitive; full account takeover requires chaining with a separate LEMUR_TOKEN_SECRET disclosure vulnerability, after which a forged HS256 admin JWT yields HTTP 200 with role=admin. A public proof-of-concept walkthrough exists (asciinema); no active exploitation is confirmed in CISA KEV.
Signer confusion in wolfSSL's PKCS7_verify implementation allows a crafted PKCS#7 message to report a trusted certificate as the signer even when an attacker-controlled certificate produced the actual signature. Any application using wolfSSL for PKCS#7 signature verification - including JWT workflows flagged in the CVE tags - may incorrectly authorize operations as if from a trusted party. No public exploit has been identified at time of analysis, but the upstream fix is available as GitHub PR #10203 and the vulnerability is straightforwardly reproducible by anyone familiar with PKCS#7 certificate bundle structure.
PKCS#12 MAC verification in wolfSSL accepts truncated or zero-length MACs because the comparison uses an attacker-controlled length field parsed from the input structure rather than the expected digest size, completely defeating HMAC integrity protection on PKCS#12 key stores. Any wolfSSL-based application that parses PKCS#12 files from untrusted sources - including certificate import endpoints, VPN provisioning services, or key management systems - can be tricked into accepting a structurally tampered PKCS#12 bundle as MAC-verified. No public exploit code or CISA KEV listing has been identified; the upstream fix is available as GitHub PR #10192 but a tagged patched release has not been independently confirmed.
HMAC tag forgery in wolfSSL's OpenSSL-compatibility layer allows a zero-length or arbitrarily truncated HMAC tag to pass verification in EVP_DigestVerifyFinal, undermining message authentication for any application relying on this API path. Applications compiled with the OPENSSL_EXTRA flag that use EVP_DigestVerifyFinal for HMAC verification - including JWT validation libraries and message authentication flows - are affected across all currently-known wolfSSL versions. The root length check only enforced that the supplied tag did not exceed the MAC size, not that it equaled it, so an attacker controlling the tag buffer or length argument could present an empty signature and bypass integrity verification. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Linked-Data Signature normalization in Mastodon's ActivityPub federation layer permits activity spoofing against servers running versions prior to 4.5.10, 4.4.17, and 4.3.23. An attacker can take a legitimately signed JSON-LD activity from a real third-party actor, re-arrange its structure, and relay it to a target Mastodon instance where it passes signature validation but is interpreted with altered semantic meaning. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the integrity impact on federated social graph trust is meaningful for operators of public-facing instances.
Signature substitution in CoreWCF's WS-Security message processing allows a remote unauthenticated attacker to replace the server's cryptographic integrity check with a signature of the attacker's choosing, effectively forging authenticated SOAP messages. Affected versions of CoreWCF.Primitives perform a document-wide lookup for ds:Signature elements rather than scoping verification to the wsse:Security header, so an attacker-injected signature in a preceding SOAP header is found and verified first. Exploitation is constrained by two non-default server-side prerequisites, limiting widespread risk on generic deployments, but the integrity bypass is complete where those conditions are met. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT signature verification (CWE-347), allowing remote attackers to forge authentication tokens without valid credentials and gain unauthorized access to protected LMS resources. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms fully unauthenticated, low-complexity network exploitation, enabling an attacker to impersonate enrolled students or instructors and read or modify course-related data. No public exploit code or active exploitation has been confirmed at time of analysis, and the vulnerability is not listed in CISA KEV.
Algorithm-confusion in Symfony's Mailomat webhook parser allows an attacker to downgrade the HMAC primitive used for signature verification, bypassing webhook authentication. Symfony packages symfony/mailomat-mailer and symfony/symfony versions 7.2.0 through 7.4.12 and 8.0.0 through 8.0.12 accept an attacker-controlled algorithm field from the inbound X-MOM-Webhook-Signature request header and pass it directly to PHP's hash_hmac(), enabling an adversary who can exploit cryptographic weaknesses in weaker HMAC primitives (e.g., HMAC-MD4 existential forgery) to inject fraudulent webhook payloads. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Signature metadata trust bypass in Apache CXF's JwsJsonContainerRequestFilter allows an attacker who can send JWS JSON-signed requests to inject unvalidated metadata - such as Content-Type or protected HTTP headers - by placing it in the first signature entry of a multi-signature JWS JSON token, even when that entry's signature was never verified. Affected deployments using the cxf-rt-rs-security-jose-jaxrs module may incorrectly trust attacker-controlled content type or header values, steering JAX-RS entity parsing or signed-header consistency checks in unintended ways. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches 4.2.2 and 4.1.7 were published June 10, 2026.
Decryption oracle exposure in Spring Security's SAML module allows unauthenticated remote attackers (PR:N, AV:N per CVSS) to submit crafted SAML Responses, LogoutRequests, and LogoutResponses to a Service Provider endpoint and leverage the SP's private key for decryption without presenting a valid XML signature. Affected deployments span Spring Security 5.7.x through 7.0.x that use SAML-based SSO or Single Logout. No public exploit has been identified at time of analysis and EPSS data was not provided, but the attack class (XML encryption oracle) is well-documented in SAML security research and carries meaningful risk in identity-sensitive environments.
Late signature validation in Siemens kas (pip/kas >= 4.8, < 5.3) allows an attacker who has already compromised a referenced upstream repository to substitute the cryptographic key used to validate that repository's tag signatures, effectively bypassing integrity checks entirely. Because kas processes and applies configuration includes from external repositories before verifying their signatures, a malicious repository can redirect the signature-validation key to one under attacker control. No public exploit code has been identified at time of analysis, and exploitation requires a highly specific multi-condition scenario including prior supply-chain access to a referenced upstream repo. Vendor-released patch version 5.3 resolves all related attack vectors.
Private ECDH key recovery in OP-TEE prior to version 4.11.0 is achievable by a local attacker who can invoke TEE_DeriveKey with approximately 30-40 crafted public key values lying off the target elliptic curve. Because the implementation omits point validation - failing to verify that (X, Y) satisfies Y^2 ≡ X^3 + aX + b mod P for the specified curve - each malformed call leaks a residue d mod r, where d is the private key and r is the order of the attacker-chosen invalid curve. Accumulated residues allow full private key reconstruction via the Chinese Remainder Theorem. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the underlying invalid curve attack technique is well-documented in cryptographic literature and reproducible by any skilled attacker with local access.
Cookie context confusion in Django's signed cookie implementation allows a remote low-privileged attacker to substitute a cookie signed in one application context into a different context where a distinct (name, salt) pair produces the same concatenated string. Affected are Django 6.0 before 6.0.6 and Django 5.2 before 5.2.15; older unsupported series (5.0.x, 4.1.x, 3.2.x) were not evaluated but may also be affected. The real-world impact is limited to low-confidence data exposure (VC:L), with no public exploit identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects a low-severity, contextually constrained flaw.
Integrity bypass in Siemens kas (pip/kas < 5.3) allows an attacker who controls a referenced external git repository to substitute arbitrary commit content by creating a branch whose name matches the commit SHA recorded in a kas configuration file. Because kas passed the raw SHA string to `git checkout` without forcing disambiguation to a commit object, git resolves a branch of that name instead of the pinned commit, defeating the integrity guarantee users rely on. The primary impact falls on SHA-256 commit IDs; SHA-1 commits face a related but distinct risk through hash-collision substitution. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Algorithm allow-list bypass in PyJWT 2.9.0-2.12.1 permits an attacker who controls a registered JWK/JWKS private key to circumvent caller-enforced algorithm restrictions during JWT signature verification. The library correctly checks the token header's alg claim against the caller-supplied allow-list, but then performs the actual cryptographic verification using the algorithm bound to the PyJWK object rather than the header-declared algorithm - creating a exploitable mismatch. Specifically, the documented PyJWKClient.get_signing_key_from_jwt() flow is affected, meaning applications relying on this pattern for algorithm-restricted JWT validation may accept tokens signed with algorithms they explicitly prohibited. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.