Advisories

A time-of-check/time-of-use flaw in upload handling allows code execution when an authenticated user with repository write access wins a race between concurrent requests. Exploitation depends on precise timing.

Fixed in: GitHub Enterprise Server 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. Version 3.22 and later are unaffected.

Credit: ahacker1 and Harsh Jaiswal, as recorded by GitHub.

Nested iden and auxl image relationships can produce duplicate alpha planes that are mishandled by scale_nearest_neighbor(). Processing a crafted image can write beyond the allocated heap buffer and lead to code execution in the image-processing application.

Affected versions: libheif 1.22.0 through 1.23.1.

Fixed in: 1.23.2. Applications that bundle libheif must update their bundled library as well.

Credit: Harsh Jaiswal (rootxharsh), finder; hacktronai-research and KarimPwnz, coordinators.

Affected WSO2 products accept JWTs using algorithms outside the configured or supported set. An attacker can exploit the validation mismatch to gain unauthorized access and take over administrative accounts.

Affected products: API Manager, Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API utility. Install the product-specific updates listed in WSO2-2026-5328.

Credit: Hacktron Team, as acknowledged by WSO2.

CVE publication: August 6, 2026. This entry uses the CVE record publication date.

Discourse’s advisory identifies malformed HEIF uploads as a route to remote code execution through its libheif dependency. Updated Docker images include a patched library, and supported Discourse releases add image-processing sandboxing where the system kernel supports it.

Remediation: Rebuild the application using an updated Discourse Docker image and install a supported patched release. The advisory lists 2026.7.0, 2026.6.1, 2026.5.2, and 2026.1.6.

Credit: Discourse credits hacktronai-research for reporting its downstream exposure. The original libheif advisory credits Hikai for the upstream discovery.

Nuxt server islands accept props through /__nuxt_island/. If an island passes those values into dynamic component resolution, an attacker can supply a template property that Vue compiles and executes on the server. Attribute fallthrough to a polymorphic root component can also expose this path.

Affected versions: Nuxt 3.4.0 through versions before 3.21.10, and Nuxt 4 before 4.5.1, when component islands are active and expose the required dynamic-component path. Node deployments with externalized Vue can be affected even without explicitly enabling vue.runtimeCompiler.

Fixed in: Nuxt 3.21.10 and 4.5.1.

Credit: Zayne Zhang.

CVE-2026-56355 identifies an authorization flaw in GNU Savane in which untrusted input influences an access decision. The CVE record lists versions 3.14 through 3.17 as affected.

The Free Software Foundation reports that the GNU Savannah issues were resolved and acknowledges Harsh Jaiswal and Rahul Maini from Hacktron for their assistance with mitigation.

Severity: Low, following the CVE’s 3.7 CVSS assessment.

The Apple OAuth login handler falls back to a request-supplied email when the identity token does not include one. Trusting that value allows the attacker to select the account used by the login flow.

Fixed in: Rocket.Chat 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

Credit: Found by Hacktron’s PR scan, as acknowledged by Rocket.Chat.

Sonatype Nexus Repository 3 deserializes attacker-controlled data from an uploaded license file. A user with the nx-licensing-create privilege can use a crafted license to execute commands with the privileges of the Nexus process.

Affected versions: Nexus Repository 3 before 3.92.0.

Fixed in: 3.92.0.

Credit: Rahul Maini with Hacktron AI, as acknowledged by Sonatype.

OpenAI Atlas exposed privileged browser functions to content served from *.openai.com. Cross-site scripting on the OpenAI forum could cross this trust boundary and access browsing history or control tabs.

Fixed in: Atlas 1.2025.288.15, which restricts the APIs to *.chatgpt.com.

Credit: s1r1us and Sudi of Hacktron, as recorded in the CVE. Hacktron published the research on December 2, 2025; the CVE was published on June 5, 2026.

An attacker-controlled Snowflake server can use the JDBC driver to write files on the Metabase host. Replacing a database driver turns the file write into code execution when Metabase next loads that driver. Exploitation requires permission to add or edit a database connection, typically an administrator privilege.

Fixed in: 0.54.24 / 1.54.24, 0.55.24 / 1.55.24, 0.56.25 / 1.56.25, 0.57.19 / 1.57.19, 0.58.14 / 1.58.14, 0.59.10 / 1.59.10, and 0.60.4 / 1.60.4.

The fix packages first-party drivers inside the application archive to prevent replacement on disk.

Credit: Hacktron AI.

GlobalProtect’s Cloud Authentication Service (CAS) is Palo Alto’s cloud-hosted SSO broker. Instead of the firewall talking directly to an IdP, it redirects through cloud-auth-service.<region>.apps.paloaltonetworks.com, which returns a signed JWT back to the firewall after the user authenticates with their IdP. The firewall verifies the JWT using a token-signing certificate shared across all CAS-enrolled devices.

In affected PAN-OS versions, the JWT verification routine accepts tokens signed with HS256 using the public CAS token-signer certificate as the HMAC key, a classic algorithm-confusion bug. Any party able to fetch the public certificate (which is served by the CAS metadata endpoint, reachable using any valid device mTLS client cert) can forge tokens for arbitrary users.

Exploitation requirements:

• The target’s username (typically the user’s email address).
• The device’s CSP (CAS) account ID, which can be derived from the device serial number leaked in the outbound login JWT, then resolved via the Palo Alto license API (license.api.paloaltonetworks.com/entitlements/v1/device?serialNumber=<SN>) with any registered device’s mTLS cert.
• The public token-signing certificate from the CAS metadata endpoint.

Result: full GlobalProtect VPN authentication bypass against deployments configured with CAS as the auth backend: the attacker connects to the corporate VPN as the target user with knowledge of only their username.

Research by @rootxharsh. See Palo Alto’s security advisory for affected versions and patched releases.

App Router applications that use Content Security Policy nonces can be vulnerable to stored cross-site scripting when deployed behind a shared cache.

Next.js derives the per-request CSP nonce from request headers in order to apply it to rendered HTML. In affected versions, malformed nonce values were not sufficiently sanitized before being embedded into the response, allowing an attacker to break out of the intended attribute context and inject script into the rendered HTML.

When the response is served from a shared cache (CDN, reverse proxy), the poisoned output is replayed to subsequent visitors, turning the CSP-nonce mechanism (normally a defense against XSS) into a stored XSS vector.

Affected versions: >= 13.4.0 < 15.5.16 and >= 16.0.0 < 16.2.5

Fixed in: 15.5.16, 16.2.5

CVSS 3.1: 4.7 (Moderate), CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

The fix rejects or ignores malformed nonce values before they are embedded into HTML and applies stricter sanitization so request-derived nonce data cannot break out of the attribute context.

Workaround: strip inbound Content-Security-Policy request headers from untrusted traffic at the edge until upgrading.

Self-hosted Next.js applications using the built-in Node.js server can be coerced into server-side request forgery through crafted WebSocket upgrade requests.

By sending a single crafted HTTP request that combines a WebSocket Upgrade header with an absolute-form URI, an unauthenticated attacker can convince the Next.js process to proxy the request to any host and port reachable from the server, then return the response to the attacker. This includes cloud metadata services on port 80 (AWS IMDSv1, GCP metadata, Azure IMDS, Oracle OCI, DigitalOcean metadata) as well as internal administrative panels and APIs.

The HTTP request handler already gated proxy calls behind a routing-completion check; the WebSocket upgrade handler did not. The fix applies the same safety check: upgrade requests are only proxied when routing has explicitly marked them as safe external rewrites (destructuring finished and statusCode from resolveRoutes and gating the proxy call on finished && parsedUrl.protocol && !statusCode).

Affected versions: >= 13.4.13 < 15.5.16 and >= 16.0.0 < 16.2.5, self-hosted only.

Not affected: Vercel-hosted deployments.

Fixed in: 15.5.16, 16.2.5

CVSS 3.1: 8.6 (High), CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE-918: Server-Side Request Forgery.

Approximately 79,000 Shodan-indexed Next.js hosts on the default port were exposed at disclosure time.

Next.js middleware is commonly used as the gatekeeper for authentication and authorization on dynamic routes. In affected versions, specially crafted query parameters can alter the dynamic route value seen by the rendered page while leaving the path observed by middleware unchanged.

An attacker can therefore reach a protected dynamic route handler (and have it render protected content) without their request ever appearing to middleware as a request to that route. Applications relying on middleware path matching as their primary authorization layer can be bypassed.

The fix only honors internal route-parameter normalization in trusted routing flows and rejects externally-supplied encodings that would diverge from the visible path.

Affected versions: >= 15.4.0 < 15.5.16 and >= 16.0.0 < 16.2.5

Fixed in: 15.5.16, 16.2.5

CVSS 3.1: 8.1 (High), CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Workaround: until upgrading, implement authorization logic at the route or page level rather than relying exclusively on middleware path matching.

An incorrect regular expression permits OAuth callback URLs that should be rejected. An attacker who knows a first-party OAuth application’s registered callback URL can craft an authorization link that redirects the resulting code to a domain they control when a victim follows it.

Fixed in: GitHub Enterprise Server 3.14.26, 3.15.21, 3.16.17, 3.17.14, 3.18.8, 3.19.5, and 3.20.1. Version 3.21 and later are unaffected.

Credit: ahacker1 and hacktron, as recorded by GitHub.

When oauth2-proxy is used in auth_request integrations (e.g. nginx auth_request) with --ping-user-agent set or --gcp-healthchecks enabled, oauth2-proxy treats any request bearing the configured health check User-Agent as a successful health check, regardless of the requested path.

An unauthenticated attacker can spoof this User-Agent string to bypass authentication and access any protected upstream resource without completing the normal login flow.

The health check path bypass was not scoped to health check endpoints only, so the User-Agent match applied globally across all paths evaluated in auth_request subrequests.

Conditions for impact:

• auth_request-style subrequest integration (e.g. nginx auth_request)
• --ping-user-agent is set OR --gcp-healthchecks is enabled

Fixed in v7.15.2. Workaround: ensure the reverse proxy does not forward client-controlled User-Agent headers to the oauth2-proxy auth subrequest.

location = /oauth2/auth {
    internal;
    proxy_set_header User-Agent "oauth2-proxy-auth-request";
    proxy_pass http://127.0.0.1:4180;
}

When oauth2-proxy is configured with --reverse-proxy and at least one --skip-auth-route or --skip-auth-regex rule, it may trust a client-supplied X-Forwarded-Uri header.

An attacker can spoof this header to make oauth2-proxy evaluate authentication and skip-auth rules against a different path than what is actually forwarded to the upstream. This allows an unauthenticated remote attacker to bypass authentication and access protected routes without a valid session.

Conditions for impact:

• --reverse-proxy flag is enabled
• At least one --skip-auth-route or --skip-auth-regex rule is defined

Fixed in v7.15.2, which introduces a --trusted-proxy-ip flag. If left unset, oauth2-proxy continues to trust all source IPs for backwards compatibility, so operators must explicitly configure trusted proxy IPs after upgrading.

Workaround: strip any client-provided X-Forwarded-Uri header at the reverse proxy before it reaches oauth2-proxy, and overwrite it with the actual $request_uri.

location /internal-auth/ {
    internal;
    proxy_set_header X-Forwarded-Uri $request_uri;
    proxy_pass http://oauth2-proxy:4180/;
}

A configuration-dependent authentication bypass exists when skip_auth_routes or skip_auth_regex are used with patterns that can be widened by attacker-controlled suffixes (e.g. ^/foo/.*/bar$).

An unauthenticated attacker can send a crafted request containing a # (or URL-encoded %23) in the path, causing oauth2-proxy to match a public allowlist rule while the backend routes the request to a protected resource. The # character is a fragment delimiter, so the backend sees a different effective path than what oauth2-proxy evaluated for skip-auth matching.

Conditions for impact:

• Uses skip_auth_routes or skip_auth_regex
• Patterns use broad wildcards across path segments
• Backend interprets # as a fragment delimiter

Fixed in v7.15.2 by making path normalization more conservative before skip-auth matching, so fragment content cannot influence allowlist decisions.

Workaround: tighten or remove broad skip_auth_routes patterns, replace with exact anchored paths with explicit HTTP methods, or reject requests containing %23 or # in the path at the ingress/WAF level.

A sandbox bypass vulnerability in JetBrains YouTrack allows an attacker with administrator-level permissions to escape the server runtime sandbox and execute arbitrary code.

The impact differs across deployment types. On YouTrack Cloud, where multiple tenants share underlying hardware, a successful exploit could bypass cross-tenant isolation boundaries, potentially exposing data from other tenants on the same host. On YouTrack Server (single-tenant), the vulnerability allows privilege escalation within administrative roles but cannot cross tenant boundaries.

JetBrains implemented a mitigation within 48 hours of receiving the report and found no evidence of exploitation in any environment. YouTrack Cloud was patched automatically.

Affected versions: All YouTrack versions before 2025.3.132953 Fixed version: 2025.3.132953 and later

YouTrack Server administrators should upgrade to 2025.3.132953 or later.

OpenAM’s authentication endpoint contains a pre-authentication remote code execution vulnerability through unsafe deserialization of the jato.clientSession parameter.

The jato.clientSession parameter is processed by the Jato framework’s view bean infrastructure before any authentication logic executes. An attacker can craft a malicious serialized Java object and send it as the jato.clientSession value in a request to any OpenAM authentication endpoint.

The deserialization occurs in ClientSession.deserializeAttributes(), which calls Encoder.deserialize() → ApplicationObjectInputStream.readObject() with no whitelist filtering. The fix for jato.pageSession (CVE-2021-35464) was never applied to this parallel code path.

protected void deserializeAttributes() {
    if (this.encodedSessionString != null
        && this.encodedSessionString.trim().length() > 0) {
        this.setAttributes(
            (Map) Encoder.deserialize(
                Encoder.decodeHttp64(this.encodedSessionString), false));
    }
}

With Click-style gadget chains bundled in OpenAM’s classpath (repackaged under org.openidentityplatform.openam.click.control), an unauthenticated attacker can achieve full remote code execution.

Metabase Enterprise Edition contains a vulnerability in its serialization import functionality that allows authenticated users to achieve Remote Code Execution and Arbitrary File Read.

The EE Serialization Import endpoint accepts serialized data bundles intended for migrating Metabase instances. Insufficient validation of the imported payload allows an authenticated user to craft a malicious serialization bundle that executes arbitrary code on the server when imported.

The import process can also be abused to read arbitrary files from the server filesystem by crafting payloads that reference local file paths.

(defn import-serialized-data
  [import-path]
  ;; Vulnerable: path traversal allows reading arbitrary files
  (let [files (file-seq (io/file import-path))]
    (doseq [f files]
      (when (.isFile f)
        ;; Deserializes without validating content type
        (let [data (read-string (slurp f))]
          (process-import-entity! data))))))

The import-serialized-data function does not sanitize file paths within the import bundle, and read-string evaluates Clojure expressions, enabling code execution.

BeyondTrust Remote Support and Privileged Remote Access (PRA) products contain a pre-authentication remote code execution vulnerability in the session deserialization handler.

An unauthenticated attacker can send a crafted serialized session object to the authentication endpoint, which is deserialized without proper validation. By manipulating the serialized payload, the attacker can execute arbitrary code on the server with the privileges of the BeyondTrust service account.

This vulnerability was discovered through Hacktron AI’s variant analysis capabilities and was responsibly disclosed to BeyondTrust.

A path-normalization mismatch allows encoded requests to reach a NestJS route without executing the middleware assigned to that route. Applications are affected when they use @nestjs/platform-fastify and rely on route-specific middleware for security checks.

Fixed in: @nestjs/platform-fastify 11.1.11. Upgrade the adapter and enforce authorization in guards or handlers as appropriate.

Credit: Hacktron AI.

Astro decodes request paths when selecting a route, while application middleware can check the encoded context.url.pathname. An encoded path can therefore reach a protected page without matching the middleware’s authentication rule.

Affected versions: Astro before 5.15.8.

Fixed in: 5.15.8.

Credit: Sudi (Sudistark), as acknowledged in the Astro advisory.