https://poc.intelseclab.com/tags/jwt/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-49230-apisix-jwe-decrypt-auth-bypass/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-49230-apisix-jwe-decrypt-auth-bypass/Critical severity (CVSS 9.1) — web · CVE-2026-49230. Status: Weaponized. Affects: Apache APISIX — jwe-decrypt auth plugin (apisix/plugins/jwe-decrypt.lua). Tags: apache-apisix, jwe, jwt, integrity-bypass, cwe-354, unauthenticated, api-gateway, lua.webCriticalapache-apisixjwejwtintegrity-bypasscwe-354unauthenticatedapi-gatewayluahttps://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48558-simplehelp-oidc-auth-bypass/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-48558-simplehelp-oidc-auth-bypass/Critical severity (CVSS 10) — web · CVE-2026-48558. Status: Weaponized — forges valid privileged sessions with no credentials. Affects: SimpleHelp — remote support / RMM (remote monitoring and management) platform, OIDC authentication flow. Tags: simplehelp, rmm, oidc, jwt, alg-none, cwe-347, authentication-bypass, unauthenticated, remote, kev, actively-exploited, ransomware.webCriticalsimplehelprmmoidcjwtalg-nonecwe-347authentication-bypassunauthenticatedremotekevactively-exploitedransomwarehttps://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Sun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56271-flowise-hardcoded-jwt-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-56271 (GHSA-cc4f-hjpj-g9p8). Status: Weaponized (functional PoC forges valid admin JWTs and confirms bypass against real endpoints). Affects: Flowise — open-source low-code LLM/agent orchestration platform (enterprise edition, passport authentication middleware). Tags: flowise, ai-gateway, llm-orchestration, jwt, hardcoded-secret, authentication-bypass, cwe-321, unauthenticated, remote, privilege-escalation.webCriticalflowiseai-gatewayllm-orchestrationjwthardcoded-secretauthentication-bypasscwe-321unauthenticatedremoteprivilege-escalationhttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-68860-wp-jwt-admin-forge/Critical severity (CVSS 9.8) — web · CVE-2025-68860. Status: Weaponized. Affects: WordPress "Mobile Builder" plugin. Tags: wordpress, mobile-builder, jwt, authentication-bypass, hardcoded-secret, privilege-escalation, rest-api, python, cwe-288.webCriticalwordpressmobile-builderjwtauthentication-bypasshardcoded-secretprivilege-escalationrest-apipythoncwe-288https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-62168-squid-error-page-header-reflection-token-leak/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-62168-squid-error-page-header-reflection-token-leak/Critical severity (CVSS 10) — network · CVE-2025-62168. Status: PoC. Affects: Squid Proxy. Tags: squid, proxy, information-disclosure, header-reflection, jwt, token-leak, error-page, cwe-209, cwe-550.networkCriticalsquidproxyinformation-disclosureheader-reflectionjwttoken-leakerror-pagecwe-209cwe-550https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-9209-restropress-jwt-forgery/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-9209-restropress-jwt-forgery/Critical severity (CVSS 9.8) — web · CVE-2025-9209. Status: Weaponized. Affects: RestroPress – Online Food Ordering System (WordPress plugin). Tags: restropress, wordpress, wordpress-plugin, information-exposure, jwt, authentication-bypass, account-takeover, rest-api, mass-scanner, cwe-200, cwe-287, python.webCriticalrestropresswordpresswordpress-plugininformation-exposurejwtauthentication-bypassaccount-takeoverrest-apimass-scannercwe-200cwe-287pythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48558-simplehelp-oidc-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48558-simplehelp-oidc-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-48558. Status: PoC. Affects: SimpleHelp remote support / remote monitoring & management (RMM) server, OIDC authentication flow. Tags: simplehelp, oidc, jwt, alg-none, auth-bypass, rmm, remote-support, cisa-kev.webCriticalsimplehelpoidcjwtalg-noneauth-bypassrmmremote-supportcisa-kevhttps://poc.intelseclab.com/pocs/crypto/2026-07-05_cve-2026-45091-sealed-env-totp-leak/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/crypto/2026-07-05_cve-2026-45091-sealed-env-totp-leak/High severity — crypto · CVE-2026-45091. Status: PoC. Affects: sealed-env (davidalmeidac/sealed-env) — unseal token mechanism. Tags: jwt, sealed-env, totp, secret-disclosure, base64, token-forgery.cryptoHighjwtsealed-envtotpsecret-disclosurebase64token-forgeryhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-29000. Status: Weaponized. Affects: pac4j (JWT authentication module), used in Java web applications. Tags: pac4j, jwt, jwe, auth-bypass, alg-none, jwks, privilege-escalation, java.webCriticalpac4jjwtjweauth-bypassalg-nonejwksprivilege-escalationjavahttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45156-nextcloud-id4me-jwt-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-45156-nextcloud-id4me-jwt-bypass/High severity (CVSS 8.1) — web · CVE-2026-45156. Status: PoC. Affects: Nextcloud user_oidc app — ID4me identity provider integration. Tags: nextcloud, user_oidc, id4me, jwt, alg-none, authentication-bypass, cwe-347.webHighnextclouduser_oidcid4mejwtalg-noneauthentication-bypasscwe-347https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35030-litellm-oidc-cache-collision-authbypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-35030-litellm-oidc-cache-collision-authbypass/Critical severity (CVSS 9.1) — web · CVE-2026-35030. Status: Weaponized. Affects: LiteLLM proxy (with enable_jwt_auth: true). Tags: authentication-bypass, litellm, oidc, jwt, cache-collision, ai-gateway, cwe-287.webCriticalauthentication-bypasslitellmoidcjwtcache-collisionai-gatewaycwe-287https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30368-lightspeed-classroom-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30368-lightspeed-classroom-auth-bypass/High severity — web · CVE-2026-30368. Status: PoC. Affects: Lightspeed Classroom Management (Chrome extension for school device management). Tags: chrome-extension, wasm, jwt, ably, service-worker, education-technology, device-control, browser.webHighchrome-extensionwasmjwtablyservice-workereducation-technologydevice-controlbrowserhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1529-keycloak-org-registration-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1529-keycloak-org-registration-bypass/Critical severity — web · CVE-2026-1529. Status: PoC. Affects: Keycloak (organization/invitation feature). Tags: keycloak, jwt, invitation-token, organization-registration, authentication-bypass, sso, wordpress-adjacent, identity-provider.webCriticalkeycloakjwtinvitation-tokenorganization-registrationauthentication-bypassssowordpress-adjacentidentity-provider