#1MFA, SSO, passwordless, biometric, and identity provider tools.
Kitploit recommended
oscerd/cve-2026-84181Runnable Spring Boot and Quarkus proof-of-concept reproducing the Apache Camel camel-shiro thread-bound-subject authentication bypass, with affected…
oscerd/cve-2026-80312Runnable proof-of-concept for CVE-2026-80312, a fail-open OAuth guard in Apache Camel camel-oauth, with affected and fixed Spring Boot and Quarkus…
abraxas/openmeetings-remember-me-passwordApache OpenMeetings 9.1.0 - High - Remote - ATO - remember-me cookie replay authenticates without password
abraxas/openmeetings-soap-otp-skipApache OpenMeetings 9.1.0 - High - Remote - 2FA skip - SOAP/REST password login skips TOTP
horizon3ai/ahsaycbs-auth-bypass-rceA proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS
abraxas/pfsense-api-enroll-autoaddpfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - Paramiko AutoAddPolicy enroll
abraxas/pfsense-api-example-ssl-verifypfSense Plus MIM API toolkit b4acd7ca - Medium - Remote - Privilege leftover - official samples verify_ssl=False
abraxas/pfsense-api-unix-sock-noauthpfSense Plus MIM API toolkit b4acd7ca - High - Local - Privilege leftover - unix sock enroll no JWT
affolter-engineering/mqattackRust CLI for MQTT penetration testing: subscribe/publish, broker fingerprinting, ACL probing, topic enumeration, credential brute-force, and Last…
joda32/aditActive Directory recon and read-only security audit over ADWS (net.tcp/9389), in Go
abraxas/spark-rest-auth-bypassApache Spark 4.2.0 - High - Remote - Privilege leftover - standalone REST ignores spark.authenticate
affolter-engineering/ldapinCLI tool to perform basic LDAP task for security assessments
abraxas/hyperswitch-unsigned-webhookProof-of-concept for an unauthenticated Hyperswitch Worldpayxml webhook flaw (CWE-345/306) that forges SETTLED XML to mark payments succeeded without…
abraxas/lago-invite-atoProof-of-concept lab demonstrating a critical Lago GraphQL acceptInvite authentication bypass that enables cross-organization account takeover via…
abraxas/nextcloud-federated-ocm-tokenNextcloud 35.0.0 — federated share secret is an unscoped app password for the sharer's whole Files tree
abraxas/sonic-gnmi-noauthDocuments and reproduces a fail-open authentication flaw in SONiC gNMI where an empty UserAuth map allows unauthenticated gNMI Set and gNOI writes,…
abraxas/uptime-kuma-setup-toctouProof-of-concept for a TOCTOU race in Uptime Kuma's first-run Socket.IO setup, letting an unauthenticated attacker plant a hidden second admin and…
abraxas/vaultwarden-ip-header-spoofVaultwarden 1.37.3 default X-Real-IP trusted-local bypasses login rate limits on Docker NAT
