Security AdvisoriesSecurity Advisories

PAN-OS GlobalProtect deployments using the Cloud Authentication Service (CAS) accept inbound JWTs signed with HS256 using the public CAS token-signing certificate as the HMAC key — classic algorithm confusion. An attacker who can retrieve the public token-signer certificate (reachable via the CAS metadata endpoint using any valid device mTLS cert) can forge tokens for arbitrary users, achieving full VPN authentication bypass with only the target's username.

Pending disclosure

App Router applications using CSP nonces deployed behind shared caches are vulnerable to stored XSS. Malformed nonce values derived from request headers can be reflected into rendered HTML, allowing an attacker to poison cached responses and execute script for later visitors.

Self-hosted Next.js apps using the built-in Node.js server are vulnerable to SSRF via crafted WebSocket upgrade requests. An unauthenticated attacker can cause the server to issue an internal HTTP request to any reachable host/port — including cloud metadata endpoints (AWS IMDSv1, GCP, Azure, OCI) — and read the response. Vercel-hosted deployments are unaffected.

Pending disclosure

Specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, allowing protected content to be rendered without passing the expected middleware check. Applications relying on middleware to authorize dynamic routes can be bypassed.

A configuration-dependent authentication bypass in oauth2-proxy where an attacker can use a # fragment in the request path to widen skip_auth_routes or skip_auth_regex patterns, causing oauth2-proxy to match a public allowlist rule while the backend routes to a protected resource.

A sandbox bypass vulnerability in YouTrack allows an attacker with administrator-level permissions to execute arbitrary code. On YouTrack Cloud, this could bypass cross-tenant isolation boundaries for tenants sharing the same hardware.

Pending disclosure

Authenticated users on Metabase Enterprise Edition can achieve Remote Code Execution (RCE) and Arbitrary File Read through the EE Serialization Import endpoint.