CVE-2026-65616

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-656178.8A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, andCVE-2026-656186.5Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog CVE-2026-65627.3A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. ExecuCVE-2026-656238.7Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion duringCVE-2026-656246.9Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust CVE-2026-65638.8A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goforCVE-2026-656337.6Improper Authentication vulnerability in team-alembic AshAuthentication allows purpose-limited JWTs to be replayed as full bearer API credenCVE-2026-656348.2Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denialCVE-2026-656358.3Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenCVE-2026-656362.1Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary contenCVE-2026-656379.8Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: fromCVE-2026-656389.2Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary comma
CVE-2026-65616: High severity, CVSS 8.8 | Vulnix