Elektrine
Log in Register

#jwt

5 posts · Last used 11d

Back to Timeline
Alper_Celik
Alper Çelik :cpp: :nix: @Alper_Celik@infosec.exchange · Aug 03, 2026
i dont get much of a reason to use #JWT s at least on projects meant to be self hosted, like api tokens that are stored in db achives everything without complex renewal and revocation logic and when you need to support old protocols or simpler clients you need to implement app password kind of system and come back to needing to store hashes of tokens anyway
0
0
0
offseq
OffSequence @offseq@infosec.exchange · Jul 15, 2026
CVE-2026-45363: CRITICAL improper authentication in ruby-jwt (<2.10.3, <3.2.0) lets attackers forge JWTs with empty HMAC keys. Immediate upgrade required to 2.10.3/3.2.0. Impact: auth bypass, high integrity risk. https://radar.offseq.com/threat/cve-2026-45363-cwe-287-improper-authentication-in--588cdab561cd07ab #OffSeq #CVE202645363 #ruby #jwt #infosec
0
0
0
riverfount
Riverfount :python: :linux: @riverfount@bolha.us · Mar 26, 2026
Novo post no blog: JWT: três erros que todo mundo comete na primeira implementação Você copia o exemplo do PyJWT, funciona, e acha que está pronto. Mas a implementação padrão tem três problemas sérios: aceitar o algoritmo que o token declara, ausência de revogação, e segredo fraco. Para cada erro: o mecanismo, como explorar, e como corrigir. https://riverfount.dev.br/posts/jwt_tres_erros/ #python #segurança #jwt #autenticação
2
0
1
wtfismyip
wtfismyip @wtfismyip@gnu.gl · Feb 11, 2026

High severity authorization #vulnerability in Keycloak:

  1. Of course it's because of JWT
  2. If a project with a sole purpose is authn/authz is getting #JWT wrong, you probably are too.

https://github.com/advisories/GHSA-hcvw-475w-8g7p

5
0
0

You've seen all posts