crypto — PoC Archivehttps://poc.intelseclab.com/pocs/crypto/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000Apache Druid Kerberos Cookie-Signing Secret Recovery via ThreadLocalRandom Seed Inversion (CVE-2025-59390)https://poc.intelseclab.com/pocs/crypto/2026-07-06_cve-2025-59390-druid-kerberos-threadlocalrandom-seed-recovery/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/crypto/2026-07-06_cve-2025-59390-druid-kerberos-threadlocalrandom-seed-recovery/Critical severity (CVSS 9.8) — crypto · CVE-2025-59390. Status: PoC. Affects: Apache Druid — Kerberos authenticator (druid.auth.authenticator.kerberos). Tags: apache-druid, kerberos, threadlocalrandom, prng, seed-recovery, cookie-forgery, authentication-bypass, cwe-338.cryptoCriticalapache-druidkerberosthreadlocalrandomprngseed-recoverycookie-forgeryauthentication-bypasscwe-338sealed-env Unseal Token TOTP/Enterprise Secret Disclosure (CVE-2026-45091)https://poc.intelseclab.com/pocs/crypto/2026-07-05_cve-2026-45091-sealed-env-totp-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/crypto/2026-07-05_cve-2026-45091-sealed-env-totp-leak/High severity — crypto · CVE-2026-45091. Status: PoC. Affects: sealed-env (davidalmeidac/sealed-env) — unseal token mechanism. Tags: jwt, sealed-env, totp, secret-disclosure, base64, token-forgery.cryptoHighjwtsealed-envtotpsecret-disclosurebase64token-forgeryLansweeper lsrunase 2.0 / lsencrypt 2.0 — RC4 Password Recovery (CVE-2026-39031)https://poc.intelseclab.com/pocs/crypto/2026-07-05_cve-2026-39031-lansweeper-lsrunase-rc4-key-recovery/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/crypto/2026-07-05_cve-2026-39031-lansweeper-lsrunase-rc4-key-recovery/High severity — crypto · CVE-2026-39031. Status: Weaponized. Affects: Lansweeper lsrunase 2.0 / lsencrypt 2.0. Tags: lansweeper, rc4, hardcoded-key, password-recovery, cryptography, offline-decryption, cwe-321.cryptoHighlansweeperrc4hardcoded-keypassword-recoverycryptographyoffline-decryptioncwe-321