tag
Jwt
Critical
SimpleHelp OIDC Authentication Bypass via Unverified JWT Signature (CVE-2026-48558)
CVE-2026-48558·
SimpleHelp — remote support / RMM (remote monitoring and management) platform, OIDC authentication flow
patched
Critical
Flowise Enterprise Authentication Bypass via Hardcoded Default JWT Secrets (CVE-2026-56271)
CVE-2026-56271 (GHSA-cc4f-hjpj-g9p8)·
Flowise — open-source low-code LLM/agent orchestration platform (enterprise edition, passport authentication middleware)
patched
Critical
WordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860)
CVE-2025-68860·
WordPress "Mobile Builder" plugin
unpatched
Critical
Squid Proxy Sensitive Header Leak via Error Page `mailto:` Diagnostic Block (CVE-2025-62168)
CVE-2025-62168·
Squid Proxy
unpatched
Critical
RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209)
CVE-2025-9209·
RestroPress – Online Food Ordering System (WordPress plugin)
unpatched
Critical
SimpleHelp OIDC Authentication Bypass (CVE-2026-48558)
CVE-2026-48558·
SimpleHelp remote support / remote monitoring & management (RMM) server, OIDC authentication flow
patched
High
sealed-env Unseal Token TOTP/Enterprise Secret Disclosure (CVE-2026-45091)
CVE-2026-45091·
sealed-env (davidalmeidac/sealed-env) — unseal token mechanism
unpatched
Critical
pac4j JWT Authentication Bypass via Unsigned Token in JWE Wrapper — CVE-2026-29000
CVE-2026-29000·
pac4j (JWT authentication module), used in Java web applications
unpatched
High
Nextcloud user_oidc ID4me JWT Signature Bypass (CVE-2026-45156)
CVE-2026-45156·
Nextcloud user_oidc app — ID4me identity provider integration
unpatched
Critical
LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision (CVE-2026-35030)
CVE-2026-35030·
LiteLLM proxy (with enable_jwt_auth: true)
patched
High
Lightspeed Classroom Management Weak Authentication / Device Takeover — CVE-2026-30368
CVE-2026-30368·
Lightspeed Classroom Management (Chrome extension for school device management)
unpatched
Critical
Keycloak Unauthorized Organization Registration via Invitation Token Flaw — CVE-2026-1529
CVE-2026-1529·
Keycloak (organization/invitation feature)
unpatched