Authentication — PoC Archivehttps://poc.intelseclab.com/tags/authentication/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000YAMCS Missing Rate Limiting on Authentication Endpoint (CVE-2026-44596)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44596-yamcs-auth-brute-force/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44596-yamcs-auth-brute-force/Medium severity (CVSS 5.3) — web · CVE-2026-44596 / GHSA-w5r6-mcgq-7pq4. Status: PoC. Affects: yamcs-core (YAMCS mission control software). Tags: yamcs, brute-force, rate-limiting, cwe-307, authentication, oauth-token.webMediumyamcsbrute-forcerate-limitingcwe-307authenticationoauth-tokenWebSocket Authentication Brute-Force via Missing Rate Limiting (CVE-2026-27778)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27778-websocket-auth-bruteforce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27778-websocket-auth-bruteforce/Medium severity — web · CVE-2026-27778. Status: PoC. Affects: Generic Node.js/Express + ws WebSocket authentication server (demonstration/simulator app). Tags: websocket, brute-force, cwe-307, rate-limiting, authentication, nodejs, simulator.webMediumwebsocketbrute-forcecwe-307rate-limitingauthenticationnodejssimulatorVendure GraphQL Admin API Authentication Timing Attack / User Enumeration (CVE-2026-25050)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25050-vendure-user-enum/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25050-vendure-user-enum/Medium severity — web · CVE-2026-25050. Status: PoC. Affects: Vendure (NativeAuthenticationStrategy.authenticate(), Admin GraphQL API). Tags: vendure, graphql, timing-attack, user-enumeration, authentication, python, cwe-208, brute-force-enabler.webMediumvenduregraphqltiming-attackuser-enumerationauthenticationpythoncwe-208brute-force-enablerStrapi CMS Admin Account Takeover via Query Filter Bypass — CVE-2026-27886https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27886-strapi-account-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27886-strapi-account-takeover/Critical severity — web · CVE-2026-27886. Status: Weaponized. Affects: Strapi CMS (Content API). Tags: strapi, cms, account-takeover, password-reset, boolean-oracle, api-filter-bypass, authentication.webCriticalstrapicmsaccount-takeoverpassword-resetboolean-oracleapi-filter-bypassauthentication