| शीर्षक | Zhongbang CRMEB v5.6.3 Authentication Bypass by |
|---|
| विवरण | The remote_register endpoint accepts base64-encoded JSON tokens without verifying JWT signatures. Attackers can forge arbitrary tokens to create unlimited fake accounts or login as any existing user by specifying any uid value.
The root cause is using JWT::urlsafeB64Decode() instead of JWT::decode(). The former only decodes base64 without cryptographic signature verification, while the latter properly validates JWT signatures. |
|---|
| स्रोत | ⚠️ https://github.com/foeCat/CVE/blob/main/CRMEB/jwt_auth_bypass/remote_register_jwt_bypass.md |
|---|
| उपयोगकर्ता | Ho Cherry (UID 94105) |
|---|
| सबमिशन | 09/01/2026 03:53 PM (9 महीनों पहले) |
|---|
| संयम | 19/01/2026 04:28 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 341789 [CRMEB तक 5.6.3 JSON Token LoginServices.php remoteRegister uid कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|