CWE-1259.

Gitea admin API public-only token scope bypass

• Gitea
• Broken access control
• CWE-1259

Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability

• Cisco Secure Firewall Management Center (FMC)
• CWE-1259

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

• CWE-1259
• CWE-1270

<1.12.2 · fixed in 1.12.2

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

• Broken access control
• CWE-1259

<1.27.0 · fixed in 1.27.0

Apache Answer: AdminToken not invalidated after admin deactivation

• CWE-1259

<2.0.1 · fixed in 2.0.1

OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation

• CWE-1259

<0.0.0-20260420162526-f58111d2ca54 · fixed in 0.0.0-20260420162526-f58111d2ca54

jose4j is vulnerable to DoS via compressed JWE content

• CWE-1259

<0.9.6 · fixed in 0.9.6

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality.

• CWE-1259

A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) project, allows users or attackers to tr…

• CWE-1259

Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator

• WSO2 API Manager
• WSO2 Micro Integrator
• CWE-1259

A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header.

• CWE-1259

In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session management.

• CWE-1259

Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary…

• CWE-1259

Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

• Huawei HarmonyOS
• Huawei EMUI
• CWE-1259

AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity

• Broken access control
• CWE-1259

<1.8.13 · fixed in 1.8.13

Volcano has insecure permissions in volcano.sh/volcano

• CWE-1259

<1.10.0-alpha.0 · fixed in 1.10.0-alpha.0

biscuit-java vulnerable to public key confusion in third party block

• CWE-1259

>=3.0.0, <4.0.0 · fixed in 4.0.0

KubePi's JWT token validation has a defect

• 1Panel-dev KubePi
• CWE-1259

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

• Authentication bypass
• CWE-1259

<9.0.0 · fixed in 9.0.0