#1Tools for testing and implementing authentication mechanisms (e.g., MFA, SSO) and authorization policies.
Kitploit recommended
rosemary1337/cve-2026-41940Proof-of-concept exploit for CVE-2026-41940, an unauthenticated authentication bypass in cPanel/WHM using CRLF injection to leak security tokens and…
oscerd/cve-2026-23552CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak
0xblackash/cve-2025-64446CVE-2025-64446
nxploited/cve-2026-1937YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action
dezso-dfield/cve-2023-27350PaperCut NG/MG Authentication Bypass and Remote Code Execution (RCE) Exploit Tool. A standalone Bash implementation of the PaperCut exploit chain,…
sm1ee/cve-2026-39324Proof-of-concept exploit for Rack::Cookie authentication bypass (CVE-2026-39324), demonstrating session forgery via fallback coder to gain admin…
sudo-wp/sudowp-adminerA secure, zero-trust database management tool for WordPress. Fixes critical SSRF vulnerabilities (CVE-2021-21311) by enforcing local connections only.
simoesctt/sctt-2026-33-0004-forticloud-sso-identity-singularityWhile Fortinet's January 27, 2026 mitigation for **CVE-2026-24858** focuses on blocking specific accounts like `[email protected]`, it fails to…
shahin-shadow/nextjs-auth-bypassAnalysis and exploitation of a Next.js authorization bypass vulnerability (CVE-2025-29927)
typeconfused/cve-2026-24061GNU telnetd service from GNU InetUtils authentication-bypass
th-secforge/cve-2025-29972CVE-2025-29927 - Critical Security Vulnerability in Next.js
crims-on/cve-2026-29000Exploit script for CVE-2026-29000, a JWT authentication bypass in Pac4j, allowing unauthorized access using a public key.
sudo-wp/sudowp-clickfunnels-zurichA security-patched fork of the legacy ClickFunnels Classic WordPress plugin. Fixes critical Stored XSS vulnerabilities (CVE-2022-4782) while…
okkotsu1/cve-2024-47533Exploit for CVE-2024-47533, a critical authentication bypass in Cobbler XML-RPC API, granting unauthenticated admin access for educational security…
simoesctt/ctt-refraction-vortex-cve-2026-7731-Exploit for CVE-2026-7731 targeting cloud-native identity gateways by refracting JWT temporal validation to escalate privileges from admin:false to…
sumaiyafathima-code/cve-2023-27524Exploit tool for CVE-2023-27524, an authentication bypass vulnerability in Apache Superset. Enables unauthorized access to vulnerable instances for…
jfriedli/cve-2025-10294Exploit for CVE-2025-10294: authentication bypass via empty HMAC key in ownid_shared_secret, enabling JWT forgery and unauthorized WordPress admin…
nxploited/cve-2025-8359AdForest <= 6.0.9 - Authentication Bypass to Admin
