Authentication & Authorization

gkdgkd123/cve-2026-29145-everything

Reproducible PoC environment for CVE-2026-29145 Apache Tomcat CLIENT_CERT + OCSP soft-fail bypass, including exploit scripts, mock OCSP responder,…

zedxod/cve-2026-41940-poc

Proof-of-concept exploit for CVE-2026-41940, demonstrating authentication bypass in cPanel/WHM via CRLF injection and session poisoning to gain…

gmh5225/jataayu

LLM-backed AI agent security — inbound injection detection + outbound privacy protection

supraaa-1337/cve-2025-3102-exploit

Exploitation of an authorization bypass vulnerability in the SureTriggers plugin for WordPress versions <= 1.0.78, allowing unauthenticated attackers…

x41sec/pam_pkcs11

pam_pkcs11 Bugfix

bekwiner/cve-2026-47777

Detailed technical analysis of CVE-2026-47777, a high-severity authorization bypass in Mastodon's Featured Collections federation pipeline, including…

steampunk424/cve-2025-58434-unauthenticated-password-reset-flowwise

The forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or…

rootdirective-sec/cve-2026-10795-lab

Docker lab reproducing CVE-2026-10795: UpdraftPlus UpdraftCentral authentication bypass chained to plugin installation for RCE. Includes…

offseckit/cve-2026-23813

CVE-2026-23813 — AOS-CX pre-auth bypass via nginx regex. Detection script, bypass demo, config-disclosure PoC, and IDS rules.

ne0zer01/cve-2024-27198_lab

Docker-based lab for CVE-2024-27198 TeamCity authentication bypass. Includes exploit reproduction, IoC hunting with Sigma/Suricata rules, and…

sxyrxyy/cve-2024-1709-connectwise-screenconnect-authentication-bypass

Python exploit script for CVE-2024-1709, an authentication bypass vulnerability in ConnectWise ScreenConnect. Adds a new administrative user to the…

c0gnit00/cve-2026-29000

Python POC, Exploit for CVE-2026-29000

kaleth4/cve-2026-20896

Automated PoC exploit for CVE-2026-20896, a Gitea authentication bypass via directory traversal in the API authorization header, enabling…

a17-ba/cve-2026-51119

Technical analysis and advisory for CVE-2026-51119, a privilege escalation in Invixium IXM WEB allowing authenticated low-privilege users to create…

5amu/cve-2021-29156

Exploit for CVE-2021-29156

covepseng/cve-2026-49352-poc

Exploitability PoC for CVE-2026-49352 (9router Hardcoded JWT Secret Authentication Bypass)

roxanne_ardary/securecivic

SecureCivic is a citizen-built, open source identity verification platform designed for SSA adoption. It replaces private data brokers with a secure,…