Vulnerabilities
ZKEACMS Users Risk Admin Takeover via Hard-Coded JWT Key in CVE-2026-111633
Unauthenticated users can create forged JWT tokens to access admin functions in ZKEACMS versions up to 4.4. No fix status is provided in the source material.
JWT
Everything Patch Observer has reported about JWT: 2 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Organisations at Risk: fast-jwt Patch Restores Critical Token Forgery Flaw in 6.2.x
A patch for the popular Node.js library inadvertently restored a critical flaw, allowing attackers to forge tokens using public keys as secrets.