Hardcoded-Secret — PoC Archivehttps://poc.intelseclab.com/tags/hardcoded-secret/Latest proof-of-concept entries.Hugoen-usSun, 12 Jul 2026 00:00:00 +0000Flowise Enterprise Authentication Bypass via Hardcoded Default JWT Secrets (CVE-2026-56271)https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Sun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-56271 (GHSA-cc4f-hjpj-g9p8). Status: Weaponized (functional PoC forges valid admin JWTs and confirms bypass against real endpoints). Affects: Flowise — open-source low-code LLM/agent orchestration platform (enterprise edition, passport authentication middleware). Tags: flowise, ai-gateway, llm-orchestration, jwt, hardcoded-secret, authentication-bypass, cwe-321, unauthenticated, remote, privilege-escalation.webCriticalflowiseai-gatewayllm-orchestrationjwthardcoded-secretauthentication-bypasscwe-321unauthenticatedremoteprivilege-escalationWordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Critical severity (CVSS 9.8) — web · CVE-2025-68860. Status: Weaponized. Affects: WordPress "Mobile Builder" plugin. Tags: wordpress, mobile-builder, jwt, authentication-bypass, hardcoded-secret, privilege-escalation, rest-api, python, cwe-288.webCriticalwordpressmobile-builderjwtauthentication-bypasshardcoded-secretprivilege-escalationrest-apipythoncwe-288