#1Tools for managing user identities, authentication, authorization, and access controls within systems and networks.
Kitploit recommended
keycloak/keycloak
shoucheng3/ff4j__ff4j_cve-2022-44262_1-8-13Feature toggle framework for Java enabling runtime feature activation, role-based access, AOP-driven toggling, monitoring, audit trails, and a web…
squeeze440/tugtainer-pocPoC — OIDC id_token accepted without signature/audience/expiry check in Tugtainer (GHSA-crjc-6vc7-xrfh, CVE-2026-87004, CVSS 8.1).
squeeze440/terrapod-pocPoC — missing authorization on the platform-wide GPG trust-anchor store in Terrapod (GHSA-6qrc-597p-mrp9, CVE-2026-87006, CVSS 6.5).
ivanesk315/cve-2026-18963Docker-based lab and Python exploit for CVE-2026-18963, a Keycloak reset-credentials flow bypass enabling account takeover via email verification…
brainbob/cve-2026-76578Proof-of-concept exploit for CVE-2026-76578 and CVE-2026-76560, chaining anonymous LDAP ADD with a 389-ds SELFDN bypass to gain FreeIPA domain admin…
xrzmodz444/cve-2026-41940-poc-linuxProof-of-concept exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM. Supports custom payloads and verbose logging, compatible with…
icemoonhsv/tatsAnalyze and track OAuth 2.0, OIDC, and Microsoft Entra ID tokens from Burp, mitmproxy, or Chrome DevTools captures. Visualize token lifecycles,…
bombobombone/cve-2026-73318Proof-of-concept exploit for XenForo CVE-2026-73318, an authorization bypass allowing ACP administrators to trigger site-wide policy re-agreement.…
bombobombone/cve-2026-73317Proof-of-concept exploit and technical write-up for CVE-2026-73317, an authorization bypass in XenForo allowing limited admins to approve content as…
bombobombone/cve-2026-73309Proof-of-concept and technical write-up for CVE-2026-73309, an OAuth2 authentication bypass in XenForo before 2.3.13. Demonstrates empty…
htrxuan/hdwebmobile-booking-appointmentsSell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.
eugexo/security-baseline-ubuntuProduction-grade Security Baseline & Hardening Guide for Ubuntu 24.04/26.04 LTS. Kernel isolation, custom AppArmor/Firejail 0.9.80, Rootless Docker,…
0xterror/cve-2026-82329-jfrog-artifactory-Exploit PoC for CVE-2026-82329, an authentication bypass in JFrog Artifactory. Demonstrates forging JWT tokens to gain admin access and create a…
pigeonlabshq/pigeonEnforce least-privilege delegation for AI agents with signed, scoped credentials. Grant sub-agents narrow capabilities and resources, verify actions…
0xgh057r3c0n/cve-2026-41940cPanel & WHM - Authentication Bypass via Session-File CRLF Injection
0xcyp1337/cve-2026-82329Mass exploit for CVE-2026-82329, an unauthenticated authentication bypass in JFrog Artifactory. Supports single-target and batch scanning with…
matrix-org/synapseSynapse: Matrix homeserver written in Python/Twisted.
fadi002/unshackleOpen-source tool to bypass windows and linux passwords from bootable usb
