CVE-2022-39366Critical· 9.9▾ Midnightacryl-datahub missing JWT signature check
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.1%
GHSL-2022-078)The StatelessTokenService of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the StatelessTokenService of the Metadata service uses the parse method of io.jsonwebtoken.JwtParser, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.
This issue may lead to an authentication bypass.
acryl-datahub < 0.8.45Upgrade to a patched release:
acryl-datahub 0.8.45Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114616High· 7.4Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2025-55311Medium· 6.5An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2
CVE-2025-12295Medium· 6.6A weakness has been identified in D-Link DAP-2695 2.00RC13
CVE-2026-61436High· 8.6PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
CVE-2026-102273High· 7.4PyJWT is a Python implementation of JSON Web Token standards