Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-54329
CVE-2026-54329: Snipe-IT Cross-Tenant Accessory Injection via Mass Assignment
A low-privileged user in one company can silently create accessory records under a different company by passing a foreign company_id to the Accessories API, breaking multi-tenant inventory isolation.
- criticalCVE-2026-45051
CVE-2026-45051: OpenAM WebAuthn Authenticator Java Deserialization RCE
OpenAM's WebAuthn authentication module deserializes a Java object read directly from a user-controlled LDAP attribute with no class filtering, allowing an attacker who can write to that attribute…
- criticalCVE-2026-45052
CVE-2026-45052: OpenAM Liberty Discovery SOAP Improper Authorization
An unauthenticated attacker can send a raw SOAP request to OpenAM's Liberty Web Services endpoint and permanently write records into any user's LDAP identity profile, because the server performs…
- highCVE-2026-48708
CVE-2026-48708: OliveTin Concurrent Template Parsing Race Condition
OliveTin reuses a single shared Go template object across all goroutines with no locking, so two concurrent action executions can swap each other's shell command templates, running the wrong command…
- highCVE-2026-45794
CVE-2026-45794: OpenAM Push Notification Unsafe Java Deserialization via SNS Callback
A flaw in OpenAM's anonymous SNS push callback endpoint lets an attacker plant a crafted JSON blob in the server's token store, causing OpenAM to load attacker-named Java classes and deserialize…
- highCVE-2026-46498
CVE-2026-46498: OpenAM Arbitrary OAuth2 Token Minting via CTS Namespace Confusion
A logic flaw in OpenAM's token store lets a low-privileged attacker plant a crafted JSON blob and have it accepted as a valid OAuth2 bearer token, granting access to any resource with…
- highCVE-2026-46560
CVE-2026-46560: OpenAM RADIUS Client Authentication Bypass via Response Spoofing
OpenAM's RADIUS client never validates the server response, so any attacker who can race or spray a forged Access-Accept UDP packet to the client port gains a full session as any RADIUS user without…
- criticalCVE-2026-48714
CVE-2026-48714: i18next-http-middleware Prototype Pollution via Dotted Missing-Key
A bypass in i18next-http-middleware's missing-key guard lets attackers send a crafted translation key like '__proto__.polluted' over HTTP, which downstream backends split and walk directly into…
- criticalCVE-2026-48713
CVE-2026-48713: i18next-fs-backend Prototype Pollution via Crafted Missing-Key String
A crafted translation key containing __proto__ sent to the i18next missing-key persistence endpoint can overwrite properties on JavaScript's global Object prototype, potentially crashing the app or…
- high
go-chi/chi RealIP Middleware IP Spoofing via X-Forwarded-For
The chi RealIP middleware blindly trusts the leftmost value in the X-Forwarded-For header, letting any client forge their source IP and bypass access controls or corrupt audit logs.
- high
chi RealIP Middleware IP Spoofing via Unvalidated X-Forwarded-For Header
chi's built-in RealIP middleware blindly trusts client-supplied headers like X-Forwarded-For and X-Real-IP without verifying the request came from a trusted proxy, letting any attacker fake their IP…
- highCVE-2026-9291
CVE-2026-9291: amazon-braket-sdk Insecure Deserialization via pickle.loads()
A user with write access to an Amazon Braket job output S3 bucket can plant a malicious results file that causes the SDK to run arbitrary code on the victim's machine when job results are retrieved.