CVE-2026-78426: fallo de gravedad baja en SUSE neuvector
Logout bypass via alternate JWT spelling
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2epss 0.2%
The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
SUSE · neuvectorCVEs relacionadas — SUSE neuvector
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-32188CRITICALJWT token compromise can allow malicious actions including Remote Code Execution (RCE)EPSS 0.6%CVE-2025-8077CRITICALNeuVector admin account has insecure default passwordEPSS 0.6%CVE-2025-54469CRITICALNeuVector Enforcer is vulnerable to Command Injection and Buffer overflowEPSS 0.5%CVE-2023-22644CRITICALJWT token compromise can allow malicious actions including Remote Code Execution (RCE)EPSS 0.5%CVE-2025-66001HIGHNeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)EPSS 0.4%CVE-2025-46808MEDIUMSensitive information is leaked into NeuVector’s manager container logsEPSS 0.3%