#1MFA, SSO, passwordless, biometric, and identity provider tools.
Kitploit recommended
0xnehru/ssh_enum_vaildA Bash script to enumerate valid SSH usernames using the CVE-2018-15473 vulnerability. It checks for valid usernames on an OpenSSH OpenSSH 7.2p2…
rootdirective-sec/cve-2026-44338-labDocker-based lab demonstrating CVE-2026-44338 authentication bypass in PraisonAI's legacy Flask API. Includes vulnerable and patched services with…
nxploited/cve-2026-114509Laravel TokenGuard authentication bypass through non-string API credentials
roxanne_ardary/e2eauthCross-platform TOTP/HOTP authenticator specification with end-to-end encrypted vault sync, local-first storage, device management, and threshold…
abraxas/pfsense-api-example-ssl-verifypfSense Plus MIM API toolkit b4acd7ca - Medium - Remote - Privilege leftover - official samples verify_ssl=False
oscerd/cve-2026-84181Runnable Spring Boot and Quarkus proof-of-concept reproducing the Apache Camel camel-shiro thread-bound-subject authentication bypass, with affected…
abraxas/spark-rest-auth-bypassApache Spark 4.2.0 - High - Remote - Privilege leftover - standalone REST ignores spark.authenticate
oscerd/cve-2026-85317Runnable Spring Boot proof-of-concept reproducing CVE-2026-85317, where camel-http's OAuth2 token cache ignores scope, resource and token endpoint,…
abraxas/pfsense-api-enroll-autoaddpfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - Paramiko AutoAddPolicy enroll
oscerd/cve-2026-84178Runnable proof-of-concept reproducer for CVE-2026-84178, a login CSRF in Apache Camel camel-oauth's authorization-code callback that redeems codes…
orevim/cve-2026-18963-pocProof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow.…
oscerd/cve-2026-85301Runnable proof-of-concept reproducer for the Apache Camel camel-keycloak issuer validation bypass (CWE-287), demonstrating affected and patched…
abraxas/openmeetings-remember-me-passwordApache OpenMeetings 9.1.0 - High - Remote - ATO - remember-me cookie replay authenticates without password
abraxas/openmeetings-soap-otp-skipApache OpenMeetings 9.1.0 - High - Remote - 2FA skip - SOAP/REST password login skips TOTP
umarrehmansiddiqui/cve-2026-0073Proof-of-concept exploit for an Android adbd Wireless Debugging TLS auth bypass, using an EC/RSA key type mismatch to obtain an unauthenticated…
aix567/c-a-sC.A.S-Exploit — Python-based security research and proof-of-concept toolkit for CVE-2017-5689 (Intel AMT authentication bypass), featuring Shodan…
xqi1337/cve-2026-0073-android-adbd-bypass-pocCVE-2026-0073 — Android ADB daemon (adbd) TLS authentication bypass via EVP_PKEY_cmp type confusion. Gain unauthorized shell access over WiFi using…
abraxas/pma-5.2.3-webauthn-2faphpMyAdmin - High 8.1 - Authenticated POST /index.php - 2FA Bypass
