Common Weakness Enumeration
CWE-1270 Generation of Incorrect Security Tokens
Description
The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1270 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-8r6w-3qq5-4p4r | CVE-2026-54593 | HIGH |
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions |
2026-07-28 | |
| GHSA-23x9-8hxr-978c | CVE-2014-2237 | HIGH |
OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend |
2025-04-13 | |
| GHSA-622h-h2p8-743x | CVE-2023-32188 | CRITICAL |
JWT token compromise can allow malicious actions including Remote Code Execution (RCE) |
2024-10-16 |