Tools

imbas007/auth-bypass-cve-2025-40554

Proof-of-concept exploit for CVE-2025-40554, an authentication bypass in SolarWinds Web Help Desk. Includes Nuclei template and Python exploit for…

heimd411/cve-2025-29927-poc

Proof-of-concept exploit for CVE-2025-29927, a Next.js middleware bypass vulnerability. Includes version fingerprinting, configurable header…

openidentityplatform/openam

Open-source access management platform offering single sign-on, adaptive authentication, authorization, and federation for secure access to web,…

vhscom/private-landing

🔐 Learn authentication by building it right. An extensible, standards-compliant reference implementation for Cloudflare Workers with Hono, Turso,…

shieldfy/api-security-checklist

Checklist of the most important security countermeasures when designing, testing, and releasing your API

umputun/reproxy

Lightweight edge HTTP(S) server and reverse proxy with automatic SSL, Docker/Consul discovery, per-route authentication, rate limiting, and…

wso2/carbon-identity-framework

Core framework for identity and access management, providing authentication, authorization, and identity governance capabilities for enterprise…

manuelberrueta/flowanalyzer

FlowAnalyzer is a tool to help in testing and analyzing OAuth 2.0 Flows, including OpenID Connect (OIDC).

placeos/auth

PlaceOS authentication service and API gatekeeper.

k3ystr0k3r/cve-2026-31816

CVE-2026-31816 - Budibase Authentication Bypass to RCE

rabbitsafe/cve-2021-37580

Proof-of-concept exploit for Apache ShenYu Admin JWT authentication bypass (CVE-2021-37580). Includes a scanning script to detect vulnerable…

0xdak/cve-2026-59243_exploit

Exploit for Apache Airflow FAB OAuth authentication bypass (CVE-2026-59243) that achieves admin access and remote code execution by triggering a…

george0papasotiriou/cve-2026-21003-jwt-none-algorithm-bypass-via-kid-header-omission

Proof-of-concept exploit for CVE-2026-21003 demonstrating JWT authentication bypass by omitting the kid header and using the 'none' algorithm to…

rajsidwadkar/uap-protocol

A unified, security-first wire protocol for tool access and agent coordination. UAP eliminates CVE-2025-49596 and MCP tool-poisoning vulnerabilities…

skelersecurity/wordpress-skelersecurity-core-security-cve-2026-63030

Temporary WordPress plugin requiring authentication for the Core REST Batch API endpoint to mitigate the wp2shell vulnerability chain…

shoucheng3/esapi__esapi-java-legacy_cve-2022-23457_2-2-3-1

Enterprise Security API library providing security controls for Java web applications, including authentication, access control, input validation,…

shoucheng3/esapi__esapi-java-legacy_cve-2022-24891_2-2-3-1

OWASP Enterprise Security API library providing security controls for Java web applications, including authentication, access control, input…