Web Application Scanning Engine Release 10.19

August 12, 2026

New Detections in WAS

Sensitive Data Exposed in JWT Token

We have added detection for sensitive data exposed in JSON Web Token (JWT) payloads, reported under QID 580568.

The TAS engine detects when a JSON Web Token used for authentication contains sensitive user data, specifically username or password fields, in its payload. During the scan, the engine extracts the JWT from the Authorization: Bearer header, decodes the payload using Base64URL decoding, and inspects the decoded JSON for username or password fields (for example, “username”, “email”, “password”, or “pwd”). If either the username or password field is present in the payload, this vulnerability is reported as a potential finding.

Enhancements for API Security

Authentication Status Reporting for Bearer and API Key Scans

Informational authentication status reporting was already supported for OAuth2 authentication under QID 150351 and QID 150352. Starting with this release, WAS API Scan extends this reporting to static Bearer token and API Key authentication.

When a user configures static Bearer or API Key authentication, the scan now reports whether the configured authentication credentials were accepted or rejected by the target API. QID 150613 and QID 150614 report the details of this authentication status, including success or failure, for the configured authentication endpoints.

Issues Addressed

Category/Component	Description
Detection	We resolved false positives in mixed-content detection when a Content Security Policy (CSP) header blocks an insecure resource. Before reporting a resource as mixed content, the scanner now reads the CSP header stored for that page and checks whether the browser would actually block the resource under that policy. This covers blanket directives (upgrade-insecure-requests, block-all-mixed-content) as well as per-resource-type directives (img-src, script-src, style-src, connect-src, media-src, object-src, frame-src, default-src). Predictable Resource Location Via Forced Browsing (QID 150004) has been updated, and certain signatures have been moved to Suspected Path Manipulation Vulnerability (QID 150622). Run a full vulnerability scan before running a retest scan. Signatures that are going to be inferred based on the responses will be reported under QID 150622 and others that have common or known patterns will continue to report under QID 150004.
Reporting	We improved reporting for favicon.ico files. This file is generated by the browser and is not identified organically during a web application crawl. To provide consistent results, vulnerabilities are now skipped on favicon.ico-based URLs.

Category/Component

Description

Detection

We resolved false positives in mixed-content detection when a Content Security Policy (CSP) header blocks an insecure resource. Before reporting a resource as mixed content, the scanner now reads the CSP header stored for that page and checks whether the browser would actually block the resource under that policy. This covers blanket directives (upgrade-insecure-requests, block-all-mixed-content) as well as per-resource-type directives (img-src, script-src, style-src, connect-src, media-src, object-src, frame-src, default-src).

Predictable Resource Location Via Forced Browsing (QID 150004) has been updated, and certain signatures have been moved to Suspected Path Manipulation Vulnerability (QID 150622). Run a full vulnerability scan before running a retest scan. Signatures that are going to be inferred based on the responses will be reported under QID 150622 and others that have common or known patterns will continue to report under QID 150004.

Reporting

We improved reporting for favicon.ico files. This file is generated by the browser and is not identified organically during a web application crawl. To provide consistent results, vulnerabilities are now skipped on favicon.ico-based URLs.

Qualys Notifications: Application Security Detections Published in July 2026

Last updated: August, 2026