Muhammad Noman Ilyas AL-Cybision

👨🏻‍💼 Muhammad Noman Ilyas (AL-Cybision)

🛡️ Application Security & Vulnerability Researcher
🔗 Huntr Profile : https://huntr.com/users/al-cybision 🔗 HackerOne Profile : https://hackerone.com/al_cybision

🔍 SECURE CODE REVIEW 🛡️ VULNERABILITY RESEARCH 🤖 AI/ML MODEL FILE VULNS

Highlights

🪲 Vulnerabilities Discovered

CVE ID	CVSS	Project	Summary	References
CVE-2026-6691	🔴 8.6 High	🍃 MongoDB C Driver	Cyrus SASL username canonicalization heap buffer overflow via unsafe string copy leads to RCE & DoS	CDRIVER-6134
CVE-2025-11157	🔴 7.8 High	🍽️ Feast	Unsafe PyYAML deserialization in Kubernetes materializer enables arbitrary code execution	Fix PR #5643 / Huntr Report
CVE-2025-59420	🔴 7.5 High	🔐 Authlib	JWT/JWS accepts unknown `crit` headers → possible authz bypass	GHSA-9ggr-2464-2j32
CVE-2025-61920	🔴 7.5 High	🔐 Authlib	DoS via oversized JOSE segments	GHSA-pq5p-34cr-23v9
CVE-2025-62706	🟡 6.5 Medium	🔐 Authlib	`zip=DEF` decompression bomb enables DoS	GHSA-g7f3-828f-7h7m

🌐 Independent Recognition & Security References

Public references below document upstream reporter credits, vendor security responses, and independent vulnerability listings.

Organization / source	Vulnerability	Type of reference	Public record
IBM — Instana OnPrem	CVE-2026-6691	Enterprise product security bulletin	View reference
IBM — watsonx.data	CVE-2025-61920	Dedicated product security bulletin	View reference
IBM — watsonx Orchestrate	CVE-2025-59420	Developer Edition security bulletin	View reference
IBM — watsonx Orchestrate	CVE-2025-61920, CVE-2025-62706	Developer Edition security bulletin	View reference
IBM — watsonx Code Assistant	CVE-2025-59420, CVE-2025-61920	On-premises product security bulletin	View reference
IBM — watsonx Code Assistant	CVE-2025-61920, CVE-2025-62706	Official release notes listing security fixes	View reference
Red Hat — OpenShift AI	CVE-2025-11157	Enterprise security advisory RHSA-2026:10184	View reference
Red Hat — Security Response	CVE-2025-11157	Public vulnerability tracking issue	View reference
Snyk	CVE-2025-11157	Names Muhammad Noman Ilyas in researcher credit	View reference
Authlib (upstream)	CVE-2025-59420	Credits AL-Cybision as reporter	View reference
Authlib (upstream)	CVE-2025-61920	Credits AL-Cybision as reporter	View reference
Authlib (upstream)	CVE-2025-62706	Credits AL-Cybision as reporter	View reference
go-jose (upstream)	JOSE `b64` header issue (non-CVE)	Credits Muhammad Noman Ilyas as reporter in merged fix	View reference
SUSE Linux Enterprise	CVE-2025-62706	Security update and fixed `python-Authlib` packages	View reference
Ubuntu / Canonical	CVE-2026-6691	Distribution vulnerability tracking	View reference
Debian Security Tracker	CVE-2026-6691	Distribution package status and fixes	View reference
Debian Security Tracker	CVE-2025-59420	Distribution package status and fixes	View reference
Debian Security Tracker	CVE-2025-61920	Distribution package status and fixes	View reference
Debian Security Tracker	CVE-2025-62706	Distribution package status and fixes	View reference
INCIBE-CERT (Spain)	CVE-2026-6691	National cybersecurity vulnerability entry	View reference
INCIBE-CERT (Spain)	CVE-2025-11157	National cybersecurity vulnerability entry	View reference
GitHub Advisory Database	CVE-2025-11157	Reviewed Feast package security advisory	View reference
GitLab Advisory Database	CVE-2025-59420, CVE-2025-61920, CVE-2025-62706	Published Authlib package advisories	View reference
Tenable	CVE-2025-62706	SUSE package-security detection advisory	View reference
NIST National Vulnerability Database	CVE-2025-11157	National vulnerability record for Feast	View reference

🔒 Private Validated Findings

Status	Area	Public-safe summary
Private / Validated	joblib model-file security	Load-time model artifact deserialization issue leading to code-execution risk and scanner-evasion behavior. Technical details withheld until disclosure.
Private / Validated	Keras `.keras` model-file security	Safe-mode model-loading bypass class involving model configuration/data-loading behavior, aligned with later public Keras CVE-2025-12058 research. Technical details withheld until disclosure.