Authentication & Authorization

cspf-founder/darwis-taxii

A high-performance TAXII (Trusted Automated eXchange of Indicator Information) server written in Rust.

tc4dy/cve-2026-29000-poc-exploit

CVE-2026-29000 – pac4j-jwt Authentication Bypass (CVSS 10.0). One-click admin forge via public key JWE wrapping. Leaks configs, users, secrets.…

aymanelsherif/oracle-oam-authentication-bypas-exploit

Exploit for Oracle Access Manager padding oracle vulnerability (CVE-2018-2879)

34zy/cve-2025-52970

CVE-2025-52970 - FortiWeb Authentication Bypass to Remote Code Execution Exploit

ajinabraham/oauth-request-crafter

OAuth Request Crafter

abraxas/mysql-set-role-leftover

MySQL Community Server 26.7.0 - High - SET ROLE ALL EXCEPT leftover FILE - mysqld UID write

chelof100/acp-framework-en

Agent Control Protocol (ACP) — Official English specification. Cryptographically verifiable authorization architecture for autonomous AI agents.

anthonyk2923/cve-2026-94609

Write-up and proof-of-concept for CVE-2026-94609, an authentik privilege-escalation flaw letting users with add_user_to_group join superuser groups…

ayantaker/cve-2023-2986

Proof of Concept for vulnerability CVE-2023-2986 in 'Abandoned Cart Lite for WooCommerce' Plugin in WordPress

sleepycofe/cve-2021-26102

PoC of FortiWAN auth bypass (https://www.fortiguard.com/psirt/FG-IR-21-048)

henry4e36/cve-2022-1388

F5 BIG-IP iControl REST身份验证绕过漏洞

abraxas/nextcloud-webhook-tokenneeded

Nextcloud 35.0.0 — delegated Webhooks admin can mint a 1h admin app password via webhook update tokenNeeded

abraxas/joomla-levels-api

Joomla 6.1.3 - High - Remote - ACL - GET /api/v1/users/levels leaks view levels

bombobombone/cve-2026-102973

Sanitized report and local proof-of-concept script demonstrating the MediaWiki action=emailuser API EmailUserAuthorizeSend hook bypass…

bombobombone/cve-2026-102975

Sanitized report and local proof-of-concept script for CVE-2026-102975, a MediaWiki RevisionDelete API authorization bypass allowing suppression…

abraxas/grafana-signup-invite-join

Grafana OSS 13.2.3 - High - Remote - Invite join - SignUpStep2 joins pending org invites without the code

aeifkz/cve-2022-22978

CVE-2022-22978 POC Project