Unverified50% confidenceFactExact time
The root cause of the vulnerability was that the internal service did not properly validate the token signature and simultaneously used upn as a local lookup key.
1
Sources
50%
Confidence
Long-term
Relevance
10/1/2026
First Seen
Sources
Related Entities
Related Claims
Unverifiedv2.1.286 fixes multiple key redaction issues, including no longer exposing credential values when Bearer or Basic appears before the key name in error messages, and the issue of percent-encoded Bearer tokens being only partially masked.68% similarUnverified账户安全类问题最不适合自动化处理，因为它需要严格的人工身份核验，自动化处理反而可能引入新的安全漏洞65% similarUnverifiedThese local runtime tools come without passwords by default, so port bindings should be checked to avoid exposing services to the public internet.65% similarUnverified共享账号模式下账号轮换插件需在本地管理认证凭证（如Session Token或OAuth Token），打破了Cursor原生安全链条，增加了数据泄露的攻击面65% similarUnverified2014年的OpenSSL Heartbleed漏洞因边界检查缺失导致内存越界读取，攻击者可借此窃取服务器内存中的私钥和用户数据64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/965611API
curl https://kongchang.com/api/v1/knowledge/claims/965611MCP
get_claim(id=965611)