{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/lanyulei/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lanyulei:ferry:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-127281"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["ferry"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["lanyulei"],"content_html":"\u003cp\u003eA remote authentication bypass vulnerability (CVE-2026-127281) has been identified in the lanyulei ferry application, specifically within the JWT validation middleware located at middleware/auth.go. The vulnerability affects versions 1.0.0-beta.1 and 1.0.0. While the vendor was contacted, they did not respond to the disclosure. Public exploit code for this vulnerability has been made available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote attacker to bypass authentication. The CVSS 3.1 base score is 7.3.\u003c/p\u003e\n","date_modified":"2026-11-13T02:45:28Z","date_published":"2026-11-13T02:45:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ferry-auth-bypass-cve-2026-127281/","summary":"The lanyulei ferry application versions 1.0.0-beta.1 and 1.0.0 contain a vulnerability in the JWT validation middleware that allows remote, unauthenticated attackers to bypass authentication.","title":"lanyulei ferry: Improper authentication in JWT validation (CVE-2026-127281)","url":"https://feed.craftedsignal.io/briefs/2026-11-ferry-auth-bypass-cve-2026-127281/"}],"language":"en","title":"CraftedSignal Threat Feed - Lanyulei","version":"https://jsonfeed.org/version/1.1"}