Threats Tagged 'cwe-565'

Apache Airflow Keycloak provider versions before 0.10.0 have a security flaw where Keycloak access and refresh tokens are stored in separate unauthenticated cookies without validation against the signed Airflow session token. This allows an attacker with a valid Airflow login and a foreign Keycloak token to gain unauthorized privileges while maintaining their own session identity. The issue affects Airflow 3.3 or later deployments using the vulnerable Keycloak provider versions. Upgrading to apache-airflow-providers-keycloak 0.10.0 or later mitigates this vulnerability by binding tokens to the session identity.

CVE-2026-75757 is a high-severity vulnerability in ash-project's ash_admin component affecting versions from 0.9.1 up to but not including 1.3.1. The issue arises from reliance on cookies without proper validation and integrity checking, allowing an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. This occurs because the client JavaScript matches cookie names using an unanchored regular expression, enabling shadowing cookies from sibling subdomains to interfere with session parameters. The vulnerability is classified under CWE-565.

Arctic Wolf Labs has been tracking multiple campaigns built around CastleLoader, a multi-stage shellcode loader that has evolved significantly. Three distinct campaigns were identified: Urutyka, Garrigin, and Noidret. The most significant development is the integration of NeedleStealer framework payloads, marking the first observed use of Rust and Golang tooling in this campaign cluster. NeedleStealer includes a Rust-based desktop cryptocurrency wallet spoofer targeting Ledger, Trezor, and Exodus wallets, and a Golang-based malicious browser extension installer. The campaigns utilize obfuscated PowerShell stagers, IronPython runtimes, and NodeJS-based shellcode injectors. Infrastructure analysis revealed consistent naming patterns, staged domains for future operations, and the use of fraudulently obtained code-signing certificates. The campaigns consistently deploy NetSupport RAT and CastleStealer alongside the new NeedleStealer payloads, suggesting an expansion toward high-value cryptocurrency targeting.

HighVulnerabilityUnited StatesCanada#cve#cve-2026-0257#cwe-565

Serendipity versions prior to 2.6.0 contain a vulnerability where the function serendipity_setCookie() uses the HTTP Host header without validation when setting cookies. This allows an attacker who can manipulate the Host header during login to cause authentication cookies to be scoped to an attacker-controlled domain. The vulnerability enables session fixation, token leakage, and potential privilege escalation if an administrator logs in under a manipulated Host header. The issue is fixed in version 2.6.0.

CVE-2026-39324 is a critical improper authentication vulnerability in rack-session versions 2.0.0 up to but not including 2.1.2. The vulnerability arises because Rack::Session::Cookie incorrectly handles decryption failures by falling back to a default decoder instead of rejecting the cookie. This flaw allows an unauthenticated attacker to supply a crafted session cookie that is accepted as valid without knowing any configured secret, enabling manipulation of session contents and potential unauthorized access. The issue is fixed in version 2.1.2.

The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as a user ID without any cryptographic validation or authorization checks. The cookie value was used to override the determine_current_user filter, which allowed unauthenticated attackers to impersonate any user by simply setting the cookie to their target user ID. This made it possible for unauthenticated attackers to gain administrator-level access and perform any privileged actions including creating new administrator accounts, modifying site content, installing plugins, or taking complete control of the WordPress site. The vulnerability was fixed in version 1.4.0 by implementing a cryptographic token-based validation system where only administrators can initiate user simulation, and the cookie contains a random 64-character token that must be validated against database-stored mappings rather than accepting arbitrary user IDs.

The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.

Azure PlayFab Elevation of Privilege Vulnerability

HighVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2025-59247#cwe-269

Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens. This issue affects Elektraweb: before v17.0.68.