Zerosteiner

An improper token validation flaw allows a remote and unauthenticated attacker to request a JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—for any user, including administrators, provided the attacker knows the target username.

The issue is caused by a stack-based buffer overflow in the Firebird database management system. This can be exploited by a remote attacker who sends a specially crafted TCP packet to port 3050, potentially allowing the execution of arbitrary code. The vulnerability is related to a missing size check during the extraction of a group number from CNCT information.