CWE-1259 Improper Restriction of Security Token Assignment
baseThe System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (18)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-76413US | high8.2 | — | ||
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log i… | ||||
| CVE-2022-23541US | medium6.3 | — | ||
jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function… | ||||
| CVE-2024-45448US | medium5.5 | — | ||
Page table protection configuration vulnerability in the trusted firmware module
Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2022-23551US | medium5.3OT elevated | — | ||
aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity inter… | ||||
| CVE-2024-41948US | medium5.0 | — | ||
biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party blocks can be generated without transferr… | ||||
| CVE-2026-40264US | low2.7 | — | ||
OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors… | ||||
| CVE-2024-36111US | — | — | ||
KubePi is a K8s panel. Starting in version 1.6.3 and prior to version 1.8.0, there is a defect in the KubePi JWT token verification. The JWT key in the default configuration file i… | ||||
| CVE-2026-58429US | — | — | ||
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | ||||
| CVE-2026-54593US | — | — | ||
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-si… | ||||
| CVE-2026-25700US | — | — | ||
Improper Restriction of Security Token Assignment vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
Previously issued administrative tokens were no… | ||||
| CVE-2024-29371US | — | — | ||
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression rat… | ||||
| CVE-2025-56207US | — | — | ||
A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) project, allows users… | ||||
| CVE-2025-56676US | — | — | ||
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one user can be used to log… | ||||
| CVE-2024-4598US | — | — | ||
An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended b… | ||||
| CVE-2025-50579US | — | — | ||
A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin heade… | ||||
| CVE-2025-51306US | — | — | ||
In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session manag… | ||||
| CVE-2025-27955US | — | — | ||
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information an… | ||||
| CVE-2024-36533US | — | — | ||
Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. | ||||
03
attack patterns (2)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan