CWE-347 · 898 kayıt
Kriptografik imzanın hatalı doğrulanması
Neden olur?
Doğrulayıcı, hangi algoritmayla doğrulama yapacağını token’ın kendi beyanından alıyor. Güvenilmeyen veri, kendi doğrulama kuralını belirlemiş olur.
Nasıl önlenir?
- 01Kabul edilen algoritmayı sunucuda sabitleyin.
- 02Veren (iss), hedef (aud) ve süre (exp) alanlarını zorunlu doğrulayın.
- 03Asimetrik ve simetrik doğrulama ailelerini aynı uçta karıştırmayın.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
const claims = jwt.verify(token, publicKey);Düzeltilmiş
const claims = jwt.verify(token, publicKey, {
algorithms: ["RS256"],
issuer: "https://kimlik.ornek.com",
audience: "portal",
});Kodunuzda bu kalıp var mı?
Web ve API sızma testi kapsamında bu sınıfı özellikle arıyoruz. Bulgular satır numarasıyla teslim edilir.
Bu sınıftaki CVE’ler
902 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
92Hemen | CVE-2026-48558Silahlaştırılmış | SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verificationsimple-help · simplehelp · CWE-347 | Kritik9,5 | KEV | %80,2 | 12 Haz 2026 |
89Hemen | CVE-2025-59718Silahlaştırılmış | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Fortifortinet · fortiproxy · CWE-347 | Kritik9,8 | KEV | %68,0 | 9 Ara 2025 |
77Bu hafta | CVE-2026-5430Silahlaştırılmış | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeoverwso2 · api control plane · CWE-347 | Kritik10,0 | KEV | %22,3 | 6 Ağu 2026 |
73Bu hafta | CVE-2020-1464Silahlaştırılmış | Windows Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-347 | Yüksek7,8 | KEV | %38,9 | 17 Ağu 2020 |
71Bu hafta | CVE-2020-2021Silahlaştırılmış | PAN-OS: Authentication Bypass in SAML Authenticationpaloaltonetworks · pan-os · CWE-347 | Kritik10,0 | KEV | %4,3 | 29 Haz 2020 |
65Bu hafta | CVE-2013-3900Silahlaştırılmış | WinVerifyTrust Signature Validation Vulnerabilitymicrosoft · windows 10 1507 · CWE-347 | Orta5,5 | KEV | %44,6 | 11 Ara 2013 |
60Bu hafta | CVE-2026-0265Silahlaştırılmış | PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabledpaloaltonetworks · pan-os · CWE-347 | Yüksek7,2 | — | %1,0 | 13 May 2026 |
57Planlayın | CVE-2025-25292İstismar yok | Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)omniauth · omniauth saml · CWE-347 | Kritik9,3 | — | %65,0 | 12 Mar 2025 |
55Planlayın | CVE-2021-22160İstismar yok | Authentication with JWT allows use of “none”-algorithmapache · pulsar · CWE-347 | Kritik9,8 | — | %52,9 | 26 May 2021 |
51Planlayın | CVE-2018-16042İstismar yok | Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earadobe · acrobat dc · CWE-347 | Orta6,5 | — | %82,4 | 18 Oca 2019 |
50Planlayın | CVE-2025-47827Silahlaştırılmış | In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.igel · igel os · CWE-347 | Orta4,6 | KEV | %5,1 | 5 Haz 2025 |
47Planlayın | CVE-2025-59719İstismar yok | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 tfortinet · fortiweb · CWE-347 | Kritik9,8 | — | %27,3 | 9 Ara 2025 |
46Planlayın | CVE-2024-9487Kavram kanıtı | An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassedgithub · enterprise server · CWE-347 | Kritik9,5 | — | %25,6 | 10 Eki 2024 |
43Planlayın | CVE-2018-0114Kavram kanıtı | A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens ucisco · node-jose · CWE-347 | Yüksek7,5 | — | %42,6 | 4 Oca 2018 |
43Planlayın | CVE-2025-25291Kavram kanıtı | ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)omniauth · omniauth saml · CWE-347 | Kritik9,3 | — | %20,9 | 12 Mar 2025 |
43Planlayın | CVE-2024-45409Kavram kanıtı | The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectoronelogin · ruby-saml · CWE-347 | Kritik9,8 | — | %12,4 | 10 Eyl 2024 |
41Planlayın | CVE-2021-37160İstismar yok | A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwarswisslog-healthcare · hmi-3 control panel firmware · CWE-347 | Kritik9,8 | — | %8,2 | 2 Ağu 2021 |
41Planlayın | CVE-2021-33885İstismar yok | An Insufficient Verification of Data Authenticity vulnerability in B.bbraun · spacecom2 · CWE-347 | Kritik9,8 | — | %5,5 | 25 Ağu 2021 |
40Planlayın | CVE-2025-29775Kavram kanıtı | xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Commentnode-saml · xml-crypto · CWE-347 | Kritik9,3 | — | %10,1 | 14 Mar 2025 |
40Planlayın | CVE-2025-29774Kavram kanıtı | xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo Referencesnode-saml · xml-crypto · CWE-347 | Kritik9,3 | — | %9,1 | 14 Mar 2025 |
40Planlayın | CVE-2018-12356İstismar yok | An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.simple password store project · simple password store · CWE-347 | Kritik9,8 | — | %4,4 | 14 Haz 2018 |
40Planlayın | CVE-2018-8955İstismar yok | The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which albitdefender · gravityzone · CWE-347 | Kritik9,8 | — | %4,2 | 24 Eki 2018 |
40Planlayın | CVE-2018-1000076İstismar yok | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesrubygems · rubygems · CWE-347 | Kritik9,8 | — | %2,9 | 13 Mar 2018 |
40Planlayın | CVE-2018-5923İstismar yok | In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signaturehp · color laserjet cm4540 mfp firmware · CWE-347 | Kritik9,8 | — | %2,6 | 27 Mar 2019 |
40Planlayın | CVE-2019-6318İstismar yok | HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an inshp · color laserjet cm4540 mfp firmware · CWE-347 | Kritik9,8 | — | %2,6 | 11 Nis 2019 |
- CVE-2026-4855892Hemen
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
KritikCVSS 9,5KEVSilahlaştırılmışEPSS %80simple-help · simplehelp12 Haz 2026
- CVE-2025-5971889Hemen
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Forti
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %68fortinet · fortiproxy9 Ara 2025
- CVE-2026-543077Bu hafta
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %22wso2 · api control plane6 Ağu 2026
- CVE-2020-146473Bu hafta
Windows Spoofing Vulnerability
YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %38microsoft · windows 10 150717 Ağu 2020
- CVE-2020-202171Bu hafta
PAN-OS: Authentication Bypass in SAML Authentication
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %4paloaltonetworks · pan-os29 Haz 2020
- CVE-2013-390065Bu hafta
WinVerifyTrust Signature Validation Vulnerability
OrtaCVSS 5,5KEVSilahlaştırılmışEPSS %44microsoft · windows 10 150711 Ara 2013
- CVE-2026-026560Bu hafta
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
YüksekCVSS 7,2SilahlaştırılmışEPSS %1paloaltonetworks · pan-os13 May 2026
- CVE-2025-2529257Planlayın
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
KritikCVSS 9,3İstismar yokEPSS %65omniauth · omniauth saml12 Mar 2025
- CVE-2021-2216055Planlayın
Authentication with JWT allows use of “none”-algorithm
KritikCVSS 9,8İstismar yokEPSS %52apache · pulsar26 May 2021
- CVE-2018-1604251Planlayın
Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and ear
OrtaCVSS 6,5İstismar yokEPSS %82adobe · acrobat dc18 Oca 2019
- CVE-2025-4782750Planlayın
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature.
OrtaCVSS 4,6KEVSilahlaştırılmışEPSS %5igel · igel os5 Haz 2025
- CVE-2025-5971947Planlayın
An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 t
KritikCVSS 9,8İstismar yokEPSS %27fortinet · fortiweb9 Ara 2025
- CVE-2024-948746Planlayın
An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed
KritikCVSS 9,5Kavram kanıtıEPSS %25github · enterprise server10 Eki 2024
- CVE-2018-011443Planlayın
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens u
YüksekCVSS 7,5Kavram kanıtıEPSS %42cisco · node-jose4 Oca 2018
- CVE-2025-2529143Planlayın
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
KritikCVSS 9,3Kavram kanıtıEPSS %20omniauth · omniauth saml12 Mar 2025
- CVE-2024-4540943Planlayın
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
KritikCVSS 9,8Kavram kanıtıEPSS %12onelogin · ruby-saml10 Eyl 2024
- CVE-2021-3716041Planlayın
A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwar
KritikCVSS 9,8İstismar yokEPSS %8swisslog-healthcare · hmi-3 control panel firmware2 Ağu 2021
- CVE-2021-3388541Planlayın
An Insufficient Verification of Data Authenticity vulnerability in B.
KritikCVSS 9,8İstismar yokEPSS %5bbraun · spacecom225 Ağu 2021
- CVE-2025-2977540Planlayın
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
KritikCVSS 9,3Kavram kanıtıEPSS %10node-saml · xml-crypto14 Mar 2025
- CVE-2025-2977440Planlayın
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
KritikCVSS 9,3Kavram kanıtıEPSS %9node-saml · xml-crypto14 Mar 2025
- CVE-2018-1235640Planlayın
An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.
KritikCVSS 9,8İstismar yokEPSS %4simple password store project · simple password store14 Haz 2018
- CVE-2018-895540Planlayın
The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which al
KritikCVSS 9,8İstismar yokEPSS %4bitdefender · gravityzone24 Eki 2018
- CVE-2018-100007640Planlayın
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series
KritikCVSS 9,8İstismar yokEPSS %2rubygems · rubygems13 Mar 2018
- CVE-2018-592340Planlayın
In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature
KritikCVSS 9,8İstismar yokEPSS %2hp · color laserjet cm4540 mfp firmware27 Mar 2019
- CVE-2019-631840Planlayın
HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an ins
KritikCVSS 9,8İstismar yokEPSS %2hp · color laserjet cm4540 mfp firmware11 Nis 2019