tag
Cwe-347
Critical
SimpleHelp OIDC Authentication Bypass via Unverified JWT Signature (CVE-2026-48558)
CVE-2026-48558·
SimpleHelp — remote support / RMM (remote monitoring and management) platform, OIDC authentication flow
patched
Critical
FortiOS/FortiProxy/FortiSwitchManager/FortiWeb FortiCloud SSO Authentication Bypass Detection Tool (CVE-2025-59718)
CVE-2025-59718 (Fortinet advisory FG-IR-25-647; related: CVE-2025-59719)·
Fortinet FortiOS, FortiProxy, FortiSwitchManager, FortiWeb
patched
Not disclosed (unauthenticated path traversal leading to full admin JWT forgery)
Nezha Dashboard Path Traversal → JWT Secret Leak → Token Forgery — CVE-2026-53519
CVE-2026-53519 (GHSA-5c25-7vpj-9mqh)·
Nezha Dashboard (monitoring/agent management panel)
unpatched
High
Nextcloud user_oidc ID4me JWT Signature Bypass (CVE-2026-45156)
CVE-2026-45156·
Nextcloud user_oidc app — ID4me identity provider integration
unpatched