CVE-2026-50218
HIGH
8,5
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
99
Improper Control of Resource Identifiers ('Resource Injection')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Potential Impacts:
Read Application Data
Modify Application Data
Read Files Or Directories
Modify Files Or Directories
Applicable Platforms
All platforms may be affected
https://techdocs.akamai.com/guardicore-platform-agent/changelog/
https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7…