#JWT
5 stories taggedJWT.
Fortinet Fixes Two Critical Security Flaws That Let Attackers Bypass Logins Entirely
One bug hides secret keys inside web code anyone can read. Another turns a Chrome extension into a traffic spy. Neither needed a password.
Hackers Are Forging Admin Tokens to Take Over WSO2 API Manager
A critical signature-verification bug tracked as CVE-2026-5430 lets attackers forge login tokens and seize administrator accounts. Exploitation is already under way.
Attackers Are Actively Exploiting a Perfect-10 WSO2 Authentication Flaw
A critical vulnerability in the WSO2 API platform, rated as severe as it gets, lets criminals forge login credentials and walk into the back end of enterprise systems. Exploitation began on September 13.
Researchers pull a login token out of Cloudflare's edge with a browser-era ghost bug
A Spectre-style side-channel attack ran inside one Cloudflare Worker and quietly read data from another sitting on the same machine, at speeds fast enough to lift a JSON Web Token in seconds.
n8n Login Bug Let a Valid Token From One Provider Log You In as Someone Else
The workflow automation platform matched users on a single ID field and ignored who issued the token. On Enterprise setups with more than one login provider, that was enough to walk in as another person.