ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “jwt”

12 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 54Exploit / PoC 35Data breach 7Threat actor 7Malware 6Ransomware 4AI tools & infra 4AI safety & security 3Research 3Policy & legal 3Advisory 2AI research 2Tools 2Model release 1
SeverityAllcritical 55high 35medium 24low 12info 8

CVE-2026-87785: Apache Syncope: JWT subject spoofing

Apache Syncope disclosed low-severity CVE-2026-87785, a JWT subject spoofing flaw enabling authentication bypass in affected syncope-core-spring versions.

CVE-2026-87785 is a low-severity authentication bypass by spoofing vulnerability in Apache Syncope related to the configured JWKS settings for internal JWT authentication. Affected versions are syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.

oss-security · 2d agoVulnerabilityCVE-2026-87785

[webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak

A public exploit exposes JWT signing key leakage in backup software Duplicati 2.2.0.3, risking session forgery.

Exploit-DB published exploit #52646 for Duplicati 2.2.0.3, a backup application. The issue leaks the JWT signing key, which could let an attacker forge authentication tokens. The disclosure does not report any exploitation in the wild.

Exploit-DB · Aug 17, 2026Exploit / PoC

CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass

Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.

CVE-2026-87802 is a low-severity improper cryptographic signature verification flaw in Apache Syncope SRA affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. When SRA is configured for OAuth 2.0 without a JWKS set URI assigned, an attacker can forge tokens, bypassing JWT signature verification.

oss-security · 2d agoVulnerabilityCVE-2026-87802