Loading story…
A critical authentication bypass in Yuxi allowed administrator JWTs created in one deployment, including local test environments, to be reused against other internet-exposed Yuxi instances. The flaw, tracked as CVE-2026-50561 and GHSA-6959-99pq-c56x, stemmed from improper Authorization header validation and insufficient binding of tokens to a specific instance and identity context. A successful attack could let an unauthenticated remote actor bypass login, access system configuration, invoke backend management APIs, create new administrator accounts, and fully take over the backend.
Project maintainers acknowledged the issue in a public GitHub report before moving details into a private security process, and fixed it in Yuxi 0.6.2. The patch removed reliance on a historical default JWT secret, required or generated per-instance JWT secrets and instance identifiers, enforced issuer and audience checks during token creation and verification, and blocked deleted or login-locked users from continuing to use previously issued tokens. The update also added environment and initialization changes to persist JWT settings, along with new tests for the strengthened authentication controls; temporary mitigation guidance advised setting a unique non-default JWT_SECRET_KEY and avoiding direct public exposure of backend management interfaces.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-50561 was published for the critical Yuxi improper authentication flaw affecting versions before 0.6.2, describing cross-instance administrator token reuse and backend takeover risk. The entry linked the issue to GHSA-6959-99pq-c56x and the fixing commit, and noted the CVE was received from GitHub Security Advisories.
A Yuxi commit explicitly referencing GHSA-6959-99pq-c56x fixed the authentication bypass by removing acceptance of the legacy default JWT secret, requiring or generating per-instance JWT settings, and enforcing issuer and audience validation. The patch also blocked continued access by deleted or login-locked users using previously issued tokens and added tests for the new controls.
A public GitHub issue reported that Yuxi improperly validated Authorization header tokens, allowing an administrator JWT from a local or different deployment instance to be reused against other internet-exposed Yuxi instances. The report included proof-of-concept access to backend configuration and admin-user creation endpoints.
The project owner confirmed the security issue, said it would be handled through a private GitHub Security Advisory, and closed the public issue because it contained sensitive exploit details. The maintainer also said the flaw was planned to be fixed in Yuxi version 0.6.2 and that a CVE would be requested after release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in **Postiz** allows any authenticated user to escalate privileges to **SUPERADMIN** by forging JWTs through the application's **Skool integration callback**. Tracked as **`CVE-2026-48781`** and **`GHSA-j77w-h625-56q2`**, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's `JWT_SECRET`, while authentication logic trusted the token's claims without reloading the user record from the database. The bug affects Postiz versions prior to **`2.21.8`** and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated **CVSS 9.9 (Critical)**, was verified and patched by the vendor, and defenders are advised to upgrade to **`2.21.8`**, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
Jul 12, 2026
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026
Attackers are actively exploiting **CVE-2026-5430**, a CVSS 10 authentication-bypass vulnerability affecting WSO2 API Manager, API Control Plane, Traffic Manager, and Universal Gateway. The flaw results from improper JWT signature verification: vulnerable services accept tokens signed with unsupported algorithms, allowing attackers to forge JWTs with administrator privileges and bypass authentication. WatchTowr recorded exploitation attempts against its honeypots using forged administrative tokens. Successful compromise can enable full administrative account takeover and expose API backend endpoints, registered application credentials, consumer keys, and other secrets. Attackers may also be able to intercept data in transit and access internal services reachable through affected API deployments. WSO2 released fixes in April 2026 through community pull requests and subscription update levels; organizations should apply the relevant updates immediately and investigate WSO2 environments for unauthorized administrator tokens or account activity.
Sep 16, 2026