Authentication-Bypass

A missing authentication vulnerability in the jt808-server Web Management API allows remote attackers to bypass security controls via the WebMvcConfig.addInterceptors function.

Databasement versions prior to 1.10.9 contain an authentication bypass vulnerability where unverified OIDC emails are linked to local accounts, allowing attackers to assume control of administrative accounts.

The traQ messenger application prior to 3.28.3 fails to validate user consent during OAuth2 silent authorization requests, allowing unauthorized access to broader scopes.

Foxel versions through 2.4.0 contain a missing authentication vulnerability allowing unauthenticated remote attackers to bypass permission checks and retrieve arbitrary files or thumbnails via specific API endpoints.

An incorrect authorization vulnerability in smart-sso versions 2.0.1 and earlier allows authenticated users to access administrative APIs due to a permissive default configuration in PermissionFilter.

A high-severity vulnerability in a TYPO3 extension allows unauthenticated attackers to delete arbitrary frontend user accounts and retrieve sensitive user information by bypassing hash validation on action links.

ManageEngine Key Manager Plus versions prior to 7151 contain a SAML authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by presenting crafted SAML assertions.

Attackers are exploiting internet-exposed industrial refrigeration controllers using factory-default credentials to force units into defrost mode, causing temperature spikes and food spoilage across European retail chains.

The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.

A missing authentication vulnerability in madong-admin-saas version 5.1.4 and earlier allows unauthenticated remote attackers to perform full CRUD operations on tenant management and subscription API endpoints.

Network-AI versions prior to 5.15.5 contain a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory via sibling-directory paths.

Multiple vulnerabilities were discovered in the C-Kermit communication software during a code audit, including a remote code execution vector exploitable by a malicious peer and an authentication bypass with TLS certificate spoofing.

An authentication bypass vulnerability (CVE-2026-112816) in the Canonical LXD HTTPS interface allows attackers to impersonate trusted clients via crafted TLS certificate chains, granting unauthorized control over clusters, containers, and host systems.

An authentication bypass vulnerability in the Wp Social Login and Register Social Counter plugin allows unauthenticated attackers to impersonate any site user, including administrators, by spoofing OAuth email callbacks.

The russh library fails to trigger the Agent::confirm callback for SSH keys protected by the confirm constraint, allowing unauthorized signing operations by any process capable of communicating with the agent.

Fleet contains multiple vulnerabilities that can be exploited by an authenticated remote attacker to bypass security controls, escalate privileges, perform information disclosure, manipulate data, or trigger a denial-of-service condition.

OAuthLib fails to validate the device_code parameter during device flow token requests, allowing attackers with a valid client ID to illicitly obtain bearer tokens.

A path traversal vulnerability (CVE-2025-55752) in the Apache Tomcat RewriteValve component allows unauthenticated attackers to bypass security constraints and access protected files like /WEB-INF/web.xml by abusing an improper URL normalization-before-decoding processing order.

The @sylphx/pdf-reader-mcp package contains an authentication bypass vulnerability in its HTTP transport implementation that exposes local files and PDF tools to unauthorized network requests.

The shopify_app Ruby gem contains a cross-shop authorization bypass vulnerability where user-supplied shop parameters can override cryptographically verified session contexts.

A security policy bypass vulnerability in Belden ICX35 industrial gateways allows attackers to reset login lockouts, circumventing authentication security controls.

A session hijacking vulnerability in Two Factor Authentication and All-In-One Security (AIOS) WordPress plugins allows attackers to bypass MFA by providing their own valid 2FA code during a victim's login process.

The Ortto plugin for WordPress versions prior to 1.0.25 contains an authentication bypass vulnerability that allows unauthenticated attackers to overwrite plugin configurations via exposed secrets, enabling the injection of arbitrary scripts.

A privilege leftover vulnerability in Cloud Foundry UAA allows authenticated users to reuse their access tokens to impersonate a client and gain unauthorized authorities, such as the ability to create new OAuth clients.

The Social Web Suite WordPress plugin (up to 4.1.12) is vulnerable to unauthenticated SQL injection via the exclude_posts parameter and an authentication bypass due to insecure default HMAC secret key handling.

The Wild Apricot Login plugin for WordPress (<= 1.0.18) is vulnerable to authentication bypass where attackers can hijack administrative sessions by binding malicious WildApricot accounts to existing WordPress user emails via insecure SSO account mapping.

A critical unauthenticated NoSQL injection vulnerability in Rocket.Chat versions prior to 3.12.7 allows attackers to reset administrator credentials and achieve remote code execution via malicious webhook integration scripts.

A missing authentication vulnerability in Juniper Networks Session Smart Router allows unauthenticated network-based attackers to escalate privileges via crafted URL parameters on non-onboarded devices.

CVE-2026-118129 is an authentication bypass vulnerability in the Chitchatter PostMessage Handler allowing remote attackers to manipulate the parentDomain argument to perform improper authentication.

Sunhillo SureLine versions before 9.1.5 allow unauthenticated attackers to forge session cookies for arbitrary user impersonation and root-level command execution.

Authlib versions prior to 1.9.0 contain a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method returns the payload as successfully verified when provided with a JWS JSON Serialization object containing an empty signatures array, without checking for a signature or requiring a cryptographic key.

Better Auth is vulnerable to an authentication bypass where OAuth sign-in state can be used as a valid Magic Link token, allowing unauthenticated attackers to hijack user accounts or create unauthorized verified accounts.

The GoAhead embedded web server contains critical flaws in its TLS backend and authentication logic, including failure to enforce certificate revocation, improper certificate chain validation, session decryption risks, and a login bypass vulnerability.

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates.

REDAXO core versions 5.3.0 through 5.21.3 contain an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge administrative login tokens and achieve code execution.

Attackers are hijacking Dahua IP cameras and recorders via the Easy4IP P2P cloud access feature by using brute-force attacks or exploiting CVE-2021-33044 and CVE-2021-33045 to gain unauthorized device control.

An authentication bypass vulnerability in danmu_api before 1.21.7 allows unauthenticated attackers to modify server environment configurations and facilitate SSRF through crafted POST requests to environment management endpoints.

Siemens has identified an authentication bypass vulnerability in its Mendix SAML module, which could allow unauthenticated attackers to circumvent authentication controls.

Parse Server versions prior to 8.6.102 and 9.0.0-9.10.5-alpha.2 contain an authentication bypass vulnerability allowing unauthenticated actors to sign up, link identities, or log in as existing users by providing arbitrary authData.

Postiz fails to validate media paths during post creation, allowing users to read arbitrary files from the server disk and exfiltrate them via Discord attachments.

An authentication bypass vulnerability in the Craft Commerce Mollie integration allows unauthenticated attackers to mark arbitrary transactions as paid by manipulating webhook parameters.

Craft CMS contains a CRLF injection vulnerability that allows authenticated users to overwrite the CRAFT_SECURITY_KEY in the .env file, facilitating arbitrary code execution via forged signed login redirects.

CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP allowing unauthenticated administrative account creation via manipulation of the AS2-To header.

OpenReception appointment booking software prior to version 2.0.0 is vulnerable to host header injection in the confirmation email generation process, allowing unauthenticated attackers to hijack user accounts.

Kruize Autotune contains an authentication bypass in its REST API that exposes sensitive monitoring datasource credentials in cleartext via improperly serialized JSON responses.

An authentication bypass vulnerability in Mitel MiCollab versions 9.8.1.201 and earlier enables unauthenticated attackers to perform arbitrary file reads via a path traversal flaw.

PraisonAI versions 4.5.2 to before 4.6.59 contain an authorization bypass vulnerability in Discord, Slack, and Telegram approval backends, allowing unauthorized users to approve high-risk multi-agent tool calls.

WizLearn Technologies' Learning Management System (LMS) is vulnerable to an authentication bypass via specially crafted POST requests, allowing unauthenticated attackers to gain administrative access.

EverShop versions prior to 2.2.1 contain a missing authorization vulnerability in the customer address API, allowing unauthenticated attackers to manipulate other users' shipping addresses if the customer and address UUIDs are known.

Keycloak versions up to 26.8.1 are vulnerable to privilege escalation where a user with "manage-users" permissions can assign composite roles containing "realm-admin" privileges due to incomplete authorization checks.

Obot versions prior to 0.26.0 contain an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to harvest API keys by manipulating token requests.

A critical authentication bypass vulnerability exists in the Laravel token guard driver due to improper handling of JSON array input, allowing unauthorized access when using MySQL/MariaDB.

Traefik versions prior to 3.7.14 contain an access-control bypass vulnerability in the Kubernetes Ingress NGINX provider that allows unauthenticated access to backends protected by security annotations.

An authentication bypass vulnerability in JetBrains YouTrack Helpdesk allows unauthenticated attackers to hijack any user account, including administrators, by spoofing emails to trigger an insecure account merging process.

An authentication bypass vulnerability in the php-travel-agency-system allows remote attackers to gain unauthorized access by manipulating the user_id argument in admin/session.php.

Apache Pulsar Manager is vulnerable to missing authentication and authorization, leading to potential administrative credential disclosure, and will not receive patches due to the project reaching end-of-life status.

MikroTik RouterOS versions 7.24.5 and earlier contain a session token replay vulnerability in the WebFig interface that allows unauthenticated attackers to hijack administrative sessions.

A missing authorization vulnerability in the Kiro Crew WhatsApp integration allows remote attackers who are group members to hijack agent sessions and execute arbitrary commands on the host system.

Eclipse ioFog Controller versions 3.8.0 through 3.9.1 contain an authentication bypass vulnerability in operator WebSocket endpoints, allowing attackers to access exec and log sessions using self-minted bearer tokens.

Letta versions through 0.16.8 ship with a insecure compose.yaml that disables authentication middleware and exposes a PostgreSQL database with default credentials, enabling remote code execution and administrative account takeover.

IBM Langflow OSS versions 1.0.0 through 1.12.4 are vulnerable to an authorization bypass in message endpoints that enables unauthorized session hijacking, message deletion, and prompt injection.

An unauthenticated vulnerability in DWR request processing allows attackers to execute arbitrary workflow rules by chaining method calls.

An unauthenticated SQL injection vulnerability in the Registration-Edit Handler of the Events-Management-System allows remote attackers to compromise the backend database through unsanitized input parameters.

Red Hat Advanced Cluster Security for Kubernetes contains a SAML authentication flaw allowing attackers to replay unexpired assertions to obtain multiple valid session tokens.

A missing authentication vulnerability in the Remote Control Server component of eremef bandcamp-player allows remote attackers to bypass security controls via the remoteEnabled argument.

Vanus versions 0.8.0 through 0.9.0 contain a critical vulnerability allowing unauthenticated remote attackers to gain cluster-admin privileges using a hardcoded default administrative token.

Coder versions prior to 2.29.20, 2.33.12, 2.34.8, and 2.35.4 are vulnerable to an improper hostname validation flaw, allowing attackers to intercept workspace API keys via crafted redirect links.

Authenticated users can exploit a blind Server-Side Request Forgery vulnerability in Tandoor Recipes versions prior to 2.6.10 by manipulating AI provider URL inputs to map internal network resources.

OtterMind Nubase versions through 0.1.4 are vulnerable to an authentication bypass in the storage API, allowing unauthenticated attackers to read and delete private objects.

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows unauthorized tenants to escalate privileges and access sensitive financial data by forging the unsigned X-USERINFO header.

Course-tencent-cloud through version 2.0.1 contains an authentication bypass vulnerability allowing attackers to brute force 6-digit verification codes due to a lack of rate limiting or invalidation.

An authorization vulnerability in the sshportal management shell allows authenticated non-admin users to retrieve decrypted backend private SSH keys and bypass access controls.

ZKEACMS versions through 4.4 contain a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs, allowing unauthenticated attackers to forge JWT bearer tokens and bypass authentication.

Huly Platform versions through 0.7.432 contain a missing authorization vulnerability in the mergeSpecifiedPersons RPC, enabling authenticated account takeover.

WhaTicket Community through commit cf04795 is vulnerable to an authentication bypass via the /auth/signup endpoint, allowing unauthenticated attackers to self-register with administrator privileges.

A missing Sa-Token interceptor in LangChat allows unauthenticated remote attackers to access sensitive REST controllers, leading to full system compromise and credential exfiltration.

An unauthenticated authentication bypass vulnerability (CVE-2026-111692) in DataBuff ai-apm-web allows attackers to forge administrative session tokens using a hardcoded HMAC secret.

Simple Admin Core versions up to 1.8.7 contain a critical authentication bypass vulnerability allowing attackers to forge administrative JWTs using a hard-coded secret.

IceCMS versions through 4.1.5 contain a missing authentication vulnerability allowing unauthenticated attackers to perform full account takeover via the /User/updateUser API endpoint.

Misaka Danmu Server versions 2.8.9 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to modify sensitive configuration keys via the /api/ui/config-history/rollback endpoint.

FastapiAdmin versions through 3.0 contain an authentication bypass vulnerability allowing unauthenticated attackers to obtain superuser sessions via unprotected auto-login endpoints.

Webreaper Damselfly versions 4.5.3 and earlier contain an authentication bypass vulnerability in API routes that allows unauthenticated attackers to escalate privileges and perform administrative actions.

An authentication bypass vulnerability (CVE-2026-75903) in the Vulnity Security plugin for WordPress allows unauthenticated attackers to retrieve credentials and gain administrative access via misconfigured Nginx path restrictions.

An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress allows unauthenticated attackers to hijack user sessions.

ClassroomIO versions 1.0.0 and earlier contain an authorization flaw in API routes allowing authenticated students to modify or delete arbitrary lesson content across courses.

Authenticated users can escalate privileges to administrator or manage plugins by invoking unauthorized JSON-RPC methods in Leantime.

The kin-openapi library lacks cycle detection during runtime schema validation, allowing attackers to trigger an unrecoverable Go runtime stack overflow that terminates the entire host process.

CISA Malcolm versions v26.07.1 and earlier contain multiple high-severity vulnerabilities, including authentication bypass, SSRF, and authorization flaws, allowing unauthenticated or low-privileged users to gain administrative control.

Better Auth @better-auth/sso versions 1.7.0-rc.2 through 1.7.2 contain an authentication bypass vulnerability allowing attackers to impersonate other users via malicious SSO provider registration.

An authentication bypass vulnerability in Databasus versions 3.7.0 through 3.61.0 allows unauthenticated attackers to brute-force six-digit password reset codes due to a lack of rate limiting.

SmsForwarder through version 3.5.0 contains a missing authentication vulnerability in its embedded AndServer HTTP server, allowing attackers to remotely control the application and access sensitive data.

An unauthenticated authentication bypass vulnerability (CVE-2026-97657) in Abandoned Cart Pro for WooCommerce versions 10.8.0 and earlier allows attackers to perform account takeovers via XOR-malleation of recovery tokens.

Omnispace Agora Project versions prior to 26.10.0 are vulnerable to unauthenticated remote code execution due to chained SQL injection and configuration file injection.

CVE-2026-84015 is a heap-based buffer overflow vulnerability in the Remote Access PPP EAP-TLS implementation that enables unauthenticated remote code execution via network-based exploitation.

Dockhand versions prior to 1.0.45 allow unauthenticated remote attackers to perform full account takeover by exploiting an authentication bypass flaw in the global hook that incorrectly permits requests ending in static extensions.

Ikaros versions 1.2.0 through 1.2.5 are vulnerable to an authentication bypass where attackers with valid passwords can circumvent TOTP requirements by manipulating temporary login tokens.

Swann Communications SWIFI-SE2KIC security cameras contain multiple authentication bypass vulnerabilities (CVE-2026-107605, CVE-2026-107606, CVE-2026-107607) that allow unauthenticated local network attackers to access live video streams and snapshots.

IBM WebSphere Application Server versions 8.5 and 9.0 are vulnerable to an authentication bypass in the CSIv2 inbound propagation handler, potentially allowing remote unauthorized access.

Wazuh versions 3.9.0 through 4.14.7 are vulnerable to an arbitrary file overwrite attack in MasterHandler that allows cluster workers to gain root remote code execution by modifying critical configuration files.

An authentication bypass vulnerability in the Online-Examination-System Session Handler allows remote attackers to gain unauthorized access via incorrect comparison of session cookies.

An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.

An authentication flaw in the Netherman Portal del Hermano password-recovery flow allows attackers to perform account takeovers by exploiting rate-limit gaps and error-message oracles.

LibreNMS versions prior to 26.9.0 are vulnerable to LDAP filter injection, allowing unauthenticated attackers to bypass authentication and gain administrative access via crafted HTTP Basic Authorization headers.

The better-auth library's deviceAuthorization plugin fails to display client_id and scope information, enabling attackers to deceive authenticated users into authorizing malicious device codes.

Open WebUI versions 0.7.0 through 0.11.3 contain a cross-origin message handling vulnerability that allows unauthenticated websites to steal a user's session JWT via a crafted postMessage payload.

Thirty bees versions up to 1.7.0 are vulnerable to an authentication bypass in PasswordController::resolveCustomer() that enables account takeover via manipulated guest checkout processes.

The user_ok function in the Netcore NR268 CGI execution component contains an authentication bypass vulnerability, CVE-2026-108907, which allows remote attackers to gain unauthorized access.

Studio-Saelix Sencho versions up to 0.94.1 contain an authentication bypass vulnerability (CVE-2026-108522) where improper processing of the X-Forwarded-For header allows remote attackers to circumvent login rate limits.

Wukong_HRM up to commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to access sensitive HR administrative API endpoints.

The MAX platform adapter in cc-connect version 1.5.0 and earlier allows unauthenticated attackers to forge webhook updates and execute arbitrary shell commands on the host system.

An authentication bypass vulnerability in the WPO365 Login plugin allows unauthenticated attackers to hijack user sessions by replaying previously issued OIDC tokens.

An authentication bypass vulnerability (CVE-2026-104803) in the WPCOM Member WordPress plugin allows unauthenticated attackers to hijack user sessions, including administrative accounts, by exploiting insufficient nonce and session validation in the social-login callback handler.

CVE-2026-104797 allows unauthenticated attackers to change the passwords of any WordPress user, including administrators, via an unverified profile update action in the Advanced Form Integration plugin.

An authentication bypass vulnerability in the Advanced IP Blocker WordPress plugin enables unauthenticated attackers to brute-force MFA tokens and achieve complete site takeover via reusable nonces and lack of rate limiting.

An insecure permission check in the pyload-ng API allows any authenticated user to perform administrative password brute-forcing via a side-channel oracle.

A broken access control vulnerability in Vikunja allows read-only project members to retrieve sensitive link-share hashes and escalate their privileges to the permission level of those shares.

An unauthenticated remote attacker can exploit CVE-2026-107805 in Nginx UI by sending malicious requests that trigger premature staging of large, unsigned request bodies, leading to disk space and I/O exhaustion.

An authenticated user can achieve remote code execution in Nginx-UI by uploading a maliciously crafted backup file that overwrites application configuration settings.

AstronRPA versions 1.1.6 and earlier contain a cross-site scripting vulnerability in the smart-component chat that allows remote attackers to trigger arbitrary OS command execution by injecting malicious prompt content.

PHPNuxBill versions through 2025.3.20 are vulnerable to an unauthenticated time-based blind SQL injection in the radius.php FreeRADIUS REST endpoint, allowing credential and data exfiltration.

The fast-jwt library (<= 6.3.0) fails to verify JWT signatures when the 'key' configuration is falsy and 'algorithms' are explicitly defined, allowing unauthenticated attackers to forge arbitrary claims.

IBM Security Verify Access and Identity Access contain an improper authentication vulnerability (CVE-2026-16823) allowing unauthenticated remote attackers to bypass security restrictions.

TVU Networks Receiver and Transceiver firmware versions prior to 7.9 contain an authentication bypass vulnerability in the /tvu/Login endpoint, allowing unauthenticated attackers to gain administrative sessions.

A vulnerability in AsyncHttpClient causes sensitive credentials and request details to be leaked to unintended hosts when a request replay or failover is triggered.

mJobTime builds through 15.7.3.32 contain an unauthenticated SQL injection vulnerability in Login.aspx allowing attackers to execute arbitrary commands as LocalSystem via xp_cmdshell.

The @insumermodel/mppx-condition-gate and @insumermodel/mppx-token-gate packages incorrectly trust a client-supplied wallet address, allowing attackers to bypass payment requirements by referencing any qualifying wallet address.

A vulnerability in the Backstage OIDC authentication module allows authenticated users to spoof identities when using email-based resolution with unverified email providers, leading to unauthorized access.

Fresh deployments of Homer use a hardcoded default password for the admin account, allowing unauthenticated remote attackers to gain full administrative access via CVE-2026-62252.

A flaw in the Candlepin authorization filter allows low-privileged authenticated users to bypass security checks and access unauthorized resources by exploiting flawed parameter verification.

The Django-Vue-Lyadmin project up to version 3.2.12 contains a hard-coded SECRET_KEY in backend/application/settings.py, allowing remote attackers to forge JWT tokens and gain unauthorized access.

An authenticated attacker can exploit a vulnerability in SmarterTools SmarterMail to bypass security controls and hijack other user accounts via identity impersonation.

The Totolink A3002MU router (v1.0.0-B20230403.1455) contains a critical authentication bypass vulnerability in the /bin/boa web server component, allowing remote unauthenticated access.

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 through 4.17.2 are vulnerable to an authentication bypass via the AddIDPLink endpoint, allowing unauthenticated attackers to link malicious external IdP identities to victim accounts.

Ahsay AhsayCBS up to version 10.3.2 is vulnerable to unauthenticated remote OS command injection via the /rps/api/json/UpdateReceivers.do endpoint, enabling full system compromise.

Fortra released patches for three critical vulnerabilities in its Core Privileged Access Manager (BoKS) software, addressing authentication bypass, command injection, and memory corruption flaws.

The Simple Membership plugin for WordPress is vulnerable to unauthenticated account activation and credential disclosure due to insufficient input validation in activation-related endpoints.

An authentication bypass vulnerability in the Dogtag PKI CMCAuthForEST plugin allows authenticated users to obtain CA-signed certificates with arbitrary subject names due to improper session attribute handling during EST fullcmc requests.

An authenticated user can configure malicious webhook endpoints in Trigger.dev (< 4.5.2) to perform server-side request forgery (SSRF) against internal services and cloud metadata endpoints.

An authentication bypass vulnerability in the WordPress JSON API Auth plugin allows unauthenticated attackers to hijack administrative sessions via cached HTTP responses.

Mooncake versions through 0.3.13.post1 contain an authentication bypass in the HTTP metadata server, allowing unauthenticated attackers to manipulate transfer engine keys, redirect data, or trigger denial-of-service.

CVE-2026-86344 is a denial-of-service vulnerability in 389-ds-base where an unauthenticated remote attacker can exhaust the server thread pool by sending malformed LDAP messages.

A command injection vulnerability in the rubygem-foreman_remote_execution component allows authenticated attackers to execute arbitrary shell commands via the Satellite API.

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that allows unauthenticated attackers to spoof iOS or iPadOS devices using predictable identifiers.

An authentication bypass vulnerability in The Ultimate Multisite plugin allows unauthenticated attackers to log in as any WordPress user, including administrators, by manipulating the AJAX checkout process.

A vulnerability in Fastify's request validation logic (CVE-2026-84504) allows attackers to perform request body replacement when using $async JSON schema validators, leading to potential unauthorized state changes or data disclosure.

Attackers are actively exploiting an unauthenticated API authentication bypass vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager to gain administrative control via URL-encoded HTTP requests.

The @grpc/grpc-js library contains an authentication bypass vulnerability (CVE-2026-101916) where unauthorized client certificates may be treated as authorized when requireClientCertificate is disabled.

The 'MikroTrick' campaign exploits vulnerabilities in the RouterOS SSH service to achieve unauthenticated remote code execution and administrative account persistence.

An incomplete asymmetric-key guard in PyJWT (CVE-2026-102268) allows specially formatted public keys to be used as HMAC secrets, enabling universal token forgery when applications misconfigure algorithm allow-lists.

AiSOC versions 7.2.0 through 11.9.9 are vulnerable to authenticated command injection via unescaped parameters in the actions service, allowing arbitrary command execution with elevated privileges.

Rebuild versions up to 4.4.7 and 4.5.0-beta5 are vulnerable to an improper authentication flaw in the login component that permits remote attackers to bypass authentication via manipulated requests.

MODSetter SurfSense up to version 2.0.3 is vulnerable to remote command injection via the MCP Connector Integration component, allowing unauthenticated attackers to execute arbitrary system commands.

A SQL Server stored procedure parameter truncation vulnerability (CVE-2026-101878) in Bitwarden Server allows attackers to authenticate as other users by crafting overlapping SSO identifiers.

An unauthenticated remote code execution vulnerability in mall4j through 4.0 allows attackers to reset arbitrary storefront passwords via the PUT /user/updatePwd endpoint.

A vulnerability in the OpenDMARC Internationalized Domain Name Handler (up to 1.4.2) allows remote attackers to trigger an encoding error in the opendmarc_policy_query_dmarc function, with public exploit code currently available.

An authorization bypass vulnerability in the Krayin laravel-crm CanInstall middleware allows remote attackers to manipulate the admin-config-setup endpoint to circumvent security controls.

Obot versions up to commit d7e6970 contain a default configuration vulnerability that exposes the application with administrative privileges and Docker socket access to unauthenticated network actors.

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to a password reset poisoning attack, allowing unauthenticated attackers to hijack administrator accounts via Host header manipulation.

An unauthenticated remote code execution vulnerability (CVE-2026-100746) in Coolify versions 4.1.0 and earlier allows attackers to bypass authentication via the GitHub App setup flow.

The heym expression engine before version 0.0.91 is vulnerable to a sandbox escape via the DotList map/filter and fallback resolver, allowing authenticated users to achieve arbitrary Python code execution.

Coolify versions 4.1.2 and prior contain a missing authorization vulnerability in the Route-Level Middleware component, allowing remote attackers to perform unauthorized resource updates.

An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin allows unauthenticated attackers to log in as administrators by abusing a flawed login intent parameter.

stoatchat versions prior to 0.15.5 are vulnerable to an authentication bypass where attackers can use their own MFA ticket to authenticate against a victim's session.

Budibase versions prior to 3.45.0 contain an arbitrary file read vulnerability caused by enabled external JSON reference resolution during OpenAPI/Swagger file imports.

An authentication bypass vulnerability in the Grav CMS Comments plugin through version 1.2.10 allows unauthenticated attackers to exfiltrate comment data, including emails and server paths, via an improperly secured admin handler.

Flowise versions up to 3.1.4 contain an authentication bypass vulnerability in the SSO callback logic that allows attackers to hijack pending user invitations and gain unauthorized organization access.

Flowise versions up to 3.1.4 are vulnerable to unauthorized access due to missing route-level RBAC checks, allowing low-privileged API keys to read and delete sensitive chat history.

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion where authenticated users can plant symlinks to trigger recursive deletion by a root-privileged cron task, leading to potential data destruction.

OpenClaw Slack versions prior to 2026.8.1 fail to enforce sender allowlists in multi-person direct messages, allowing unauthorized participants to interact with Slack agents and access restricted tools or data.

The X-SpringBoot application up to version 6.0 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve login verification codes and hijack user accounts.

An unauthenticated account takeover vulnerability exists in the fof/oauth extension due to improper validation of unverified email addresses returned by the Discord OAuth provider, allowing attackers to hijack existing Flarum accounts.

A session-reuse vulnerability in ZITADEL Login V2 (CVE-2026-85056) allows attackers with valid credentials to bypass MFA by abandoning and restarting the login flow in organizations where MFA is not strictly enforced.

An authenticated administrator can exploit an unescaped SQL insertion vulnerability in the phpMyFAQ StopWords::add() method (CVE-2026-56738) to execute arbitrary database commands.

The social-auth-core library fails to verify signatures in the vk-app backend when the auth_key parameter is missing, allowing attackers to impersonate arbitrary VK users.

A missing authentication flaw in the Socket.IO Connect Interface of volotat Anagnorisis allows remote attackers to bypass security controls via the app.py component.

9router versions <= 0.4.80 contain an authentication bypass vulnerability where traffic from a local reverse proxy is incorrectly trusted as local loopback, allowing unauthenticated access to restricted /v1/ APIs.

9router versions 0.5.2 and earlier are vulnerable to mass assignment in the PATCH /api/settings endpoint, allowing an authenticated user to disable authentication globally and access protected API routes.

Moquette-broker versions <= 0.18.0 are susceptible to cross-tenant ACL bypass, remote unauthenticated denial-of-service, and cross-session durable storage corruption.

CVE-2026-19125 allows unauthenticated attackers to bypass authentication in the EthPress WordPress plugin (v2.3.5 and below) by supplying malformed signatures to impersonate any user with a linked Ethereum wallet.

The mcp-atlassian package contains an authentication bypass vulnerability (CVE-2026-77244) that allows unauthenticated network-adjacent attackers to execute tools using the operator's Jira and Confluence credentials.

Sync-in Server v2.3.0 and earlier is vulnerable to a 2FA bypass in the /api/auth/token endpoint, allowing attackers with known credentials to obtain unrestricted JWTs without providing TOTP codes.

Databasement versions before 1.7.14 are vulnerable to an authentication bypass where invitation tokens are improperly validated and cached, allowing attackers to hijack accounts and gain access to managed database credentials.

CVE-2026-95271 is an improper authentication vulnerability in dgtlmoon changedetection.io versions up to 0.60.7, allowing remote attackers to bypass security via the check_authentication function.

An unauthenticated time-of-check to time-of-use (TOCTOU) race condition in the nginx-ignition onboarding API allows remote attackers to create administrative accounts on fresh or reset instances.

SxDevOps versions 1.0 and 1.1 contain a hard-coded credential vulnerability in the ensure_default_superuser function, allowing remote attackers to bypass authentication and gain unauthorized access.

Webhood versions 0.9.0 and earlier contain a critical authentication bypass vulnerability (CVE-2024-31218) allowing unauthenticated attackers to create an administrative account via the PocketBase API.

IBM Guardium Data Protection version 12.2 is vulnerable to a critical deserialization flaw allowing remote, unauthenticated attackers to execute arbitrary code (CVE-2026-81657).

Obot versions 0.22.1 and earlier are vulnerable to server-side request forgery (SSRF) allowing authenticated privileged users to probe internal network resources and cloud instance metadata services.

Authenticated users can exploit a file upload vulnerability in ClipBucket v5 before 5.5.3-#182 to achieve remote code execution by bypassing MIME validation.

A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.

Vendure is vulnerable to account takeover due to the ExternalAuthenticationService allowing unverified external identity linking to existing user accounts via email matching.

Multiple vulnerabilities, including one actively exploited in the wild (CVE-2026-76460), allow unauthenticated attackers to bypass authentication and gain administrative control over Cisco ISE and ISE-PIC deployments.

Schneider Electric PowerChute Serial Shutdown version 1.5 and prior contains an improper restriction of excessive authentication attempts vulnerability (CVE-2026-13348) that may allow unauthorized account access via brute-force.

An incorrect implementation of the authentication algorithm (CVE-2026-15688) in Mitsubishi Electric GX Works3 and Motion Control Settings allows local attackers to bypass block password protections and manipulate control programs.

OpenSign versions through 2.41.3 contain an authentication bypass vulnerability allowing unauthenticated attackers to retrieve sensitive document data and download tokens when OTP verification is disabled.

OpenNHP versions up to 1.0.2 contain an authentication bypass vulnerability allowing attackers to force the use of a fallback attestation verifier via malicious input.

Trigger.dev versions before 4.6.0 contain an authentication bypass vulnerability allowing attackers to hijack GitHub App installations and gain unauthorized repository access by manipulating state cookies and installation identifiers.

A vulnerability in UVdesk Community Skeleton versions through 1.1.8 allows unauthenticated attackers to reconfigure the database and create super administrator accounts via wizard endpoints.

SigNoz versions 0.88.0 through 0.141.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to query sensitive trace analytics via the trace-funnel endpoint.

Covenant versions 0.6 and earlier contain an authentication bypass vulnerability allowing unauthenticated remote actors to gain full operator API access via the CovenantHub SignalR hub.

An unauthenticated remote code execution vulnerability in the LoginUserUtil.releaseUserIdFromCookie function of ChangeWeDer CRM allows attackers to bypass authentication through cookie manipulation.

Multiple high-severity vulnerabilities in Digital Watchdog VMAX series devices allow unauthenticated remote attackers to bypass authentication, gain root access via hard-coded credentials, and execute arbitrary system commands.

An authentication bypass vulnerability in lamp-cloud versions 5.10.0 and earlier allows unauthenticated attackers to exfiltrate sensitive JVM system properties via insecurely whitelisted API endpoints.

An authorization bypass vulnerability in pgweb versions up to 0.17.0 allows unauthenticated attackers to supply arbitrary connection strings via the /api/connect endpoint.

PHPGurukul Blood Donor Management System 1.0 is vulnerable to an authentication bypass in the admin dashboard, allowing remote attackers to gain unauthorized administrative access.

The goproxy package through version 15.3 fails to enforce authentication on CONNECT tunnel requests, allowing unauthorized network relay via the proxy.

An authentication bypass vulnerability in Krayin CRM version 2.2.6 and earlier allows unauthenticated attackers to inject arbitrary, forged email messages into the CRM inbox via the /admin/mail/inbound-parse endpoint.

Crawlab versions 0.6.3 and earlier utilize a hard-coded HMAC-SHA256 secret for JWT signing, enabling unauthenticated attackers to forge administrative tokens and achieve remote code execution.

An unauthenticated remote code execution vulnerability in Cheshire Cat AI version 1.9.2 and earlier stems from improper validation of the user_id argument within the custom authentication handler.

A publicly disclosed vulnerability in the WARP-Clash-API authorized function allows remote unauthenticated access by manipulating the SECRET_KEY argument.

Prowler versions through 5.30.0 contain an improper authentication vulnerability where the SAML ACS finish flow incorrectly derives the target tenant from an asserted email domain, enabling cross-tenant account takeover.

WeenyGenius by Howyar Technologies contains a missing authentication vulnerability allowing unauthenticated network-adjacent attackers to spoof teacher or student roles and achieve remote control of student workstations.

Attackers are actively exploiting a chain of three critical vulnerabilities (CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329) in JFrog Artifactory to bypass authentication and achieve full administrative control.

A critical authentication bypass vulnerability in rclone's S3 serving mode allows unauthenticated attackers to spoof identity via forged SigV4 signatures when '--auth-proxy' is used without '--auth-key'.

The passport-saml-encrypted library versions up to 0.1.13 contain a critical vulnerability where SAML signature verification is skipped if a specific configuration is omitted, allowing attackers to forge and inject arbitrary authentication assertions.

An insecure sandbox configuration in the Open WebUI terminal port preview feature allows authenticated users to execute arbitrary JavaScript in the application's origin, leading to session token theft and account takeover.

CyberPanel versions prior to 3.0.5 contain an authentication bypass vulnerability where two-factor authentication is not enforced on API endpoints, allowing credential-derived token misuse.

MaxSite CMS versions 109.6 and earlier contain a hardcoded encryption key in application/config/config.php, enabling unauthenticated attackers to forge administrator session cookies.

Parse Server versions before 8.6.88 and 9.10.1-alpha.7 contain an authentication bypass vulnerability in the LDAP adapter that allows attackers to perform account takeover via zero-length credentials.

The FireBox WordPress plugin is vulnerable to authenticated Remote Code Execution via an insufficiently validated blacklist and improper input sanitization in the firebox_meta REST endpoint.

Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.

XenForo versions prior to 2.3.13 contain an OAuth2 authorization code reuse vulnerability (CVE-2026-73311) that allows attackers to obtain unauthorized token pairs by submitting previously used codes.

An authentication bypass vulnerability in 389 Directory Server allows unauthenticated LDAP clients to bypass access control rules by exploiting an error in the SELFDN ACI bind-rule evaluator.

A vulnerability in 389 Directory Server allows unauthenticated attackers to elevate privileges by exploiting state confusion during SASL authentication, leading to unauthorized Directory Manager access.

An unauthenticated remote attacker can exploit a flaw in FreeIPA's self-managed OTP token access control instructions to create arbitrary Kerberos principals and grant them administrator group membership.

A critical authentication bypass vulnerability, CVE-2026-86300, exists in the Tenda AC9 firmware version 15.03.05.14, allowing remote attackers to circumvent security controls via the Web Management interface.

An authentication bypass vulnerability in SourceCodester Simple Traffic Offense System 1.0 allows remote, unauthenticated attackers to manipulate user creation via the saveuser.php script.

A remote SQL injection vulnerability in Mstfakts College-Management-System allows unauthenticated attackers to execute arbitrary database commands via the book search handler.

The HivePress Authentication plugin for WordPress through version 1.1.4 is vulnerable to authentication bypass via improper validation of Facebook OAuth tokens, allowing unauthenticated attackers to impersonate arbitrary users.

An unauthenticated XSS vulnerability in the AVideo YPTSocket plugin allows attackers to execute arbitrary JavaScript in victim browsers via crafted websocket callback messages.

Cua computer-server versions prior to 0.3.42 contain an authentication bypass vulnerability triggered when the CONTAINER_NAME environment variable is unset, allowing unauthenticated remote command execution on TCP port 8000.

The Mstore Api plugin for WordPress (<= 4.20.0) is vulnerable to authentication bypass via JWT forgery, allowing unauthenticated attackers to impersonate any user by crafting illegitimate Firebase Phone Auth tokens.

An authorization bypass vulnerability in Spring Security allows unauthenticated attackers to access restricted endpoints by injecting URL-encoded newline or carriage return characters into request paths protected by RegexRequestMatcher.

The OpenChoreo cluster-gateway fails to authenticate callers to internal management APIs, allowing unauthorized actors to perform arbitrary Kubernetes API mutations and access Secrets across connected data planes.

An authorization bypass vulnerability in ntopng prior to version 6.7.260717 allows authenticated non-administrator users to delete notification endpoints and recipients, disrupting alerting services.

QAnything 2.0.0 contains an authentication bypass vulnerability in multiple API endpoints that allows unauthenticated attackers to exfiltrate sensitive uploaded documents and knowledge base files.

An authentication bypass vulnerability in FastChat allows unauthenticated attackers to register arbitrary workers, enabling server-side request forgery and the interception of model prompts and responses.

The Aim remote tracking server version 3.29.1 contains an authentication bypass vulnerability allowing unauthenticated attackers to execute arbitrary methods and perform unauthorized data access or deletion.

Openpanel versions before 2.3.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) flaw in the /tools/site-checker endpoint that allows internal network probing and cloud metadata access.

An information disclosure vulnerability in SiYuan's API allows unauthorized remote readers to retrieve cryptographic material necessary for offline, unthrottled GPU-based cracking of encrypted notebook master passwords.

A pre-authentication heap overflow vulnerability in the MOOSCommPkt packet handling of MOOS core-moos versions up to 10.4.0 allows remote unauthenticated attackers to perform arbitrary memory writes via crafted packets.

The python-jose library version 3.5.0 and earlier fails to validate asymmetric keys during HMAC initialization, allowing attackers with a public key to forge HS256 JWT tokens.

An authentication flaw in the vhr application through commit 03abbd3 allows authenticated attackers to perform unauthorized password changes for arbitrary accounts by manipulating the account ID in PUT requests.

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php, allowing unprivileged accounts to access restricted administrative endpoints.

An authentication bypass vulnerability (CVE-2026-80465) in multiple Mendix SAML module versions allows unauthenticated attackers to hijack user sessions via improper SAML response signature validation.

An attacker with administrative page-editing permissions can achieve remote code execution in Grav versions prior to 2.0.7 by injecting arbitrary callables into page frontmatter, which are subsequently triggered by visitor requests.

Coolify versions before 4.2.0 are vulnerable to command injection via environment variable keys, allowing authenticated attackers to execute arbitrary commands on the underlying host server.

Team Password Manager versions prior to 14.184.308 contain a critical authentication bypass vulnerability in the local account password reset workflow that allows unauthenticated attackers to perform account takeovers.

Casdoor versions up to 4.0.0 contain an authentication bypass vulnerability in the upload-resource API that permits remote, unauthenticated file operations.

CVE-2023-54391 allows unauthenticated remote attackers to bypass authentication in Proxmox VE 7.0-8.0 by providing a crafted tfa-challenge parameter to the API login endpoint.

A vulnerability in VMware Tanzu Spring Security allows a remote, unauthenticated attacker to bypass security restrictions, potentially leading to unauthorized access to sensitive information.

The Support Genix WordPress plugin is vulnerable to authentication bypass and administrator account takeover due to a weak cryptographic implementation in the guest ticket login feature.

An unauthenticated remote code execution vulnerability (CVE-2026-82919) exists in the cu silicon library versions 0.1.5 and earlier due to missing authentication controls in the create_app function.

Pangolin versions prior to 1.22.0 are vulnerable to an authentication bypass in the share-link endpoint, allowing unauthenticated access to arbitrary resources.

A critical authentication bypass vulnerability in the Tenda AC18 router allows remote, unauthenticated attackers to gain unauthorized access via the Telnet service.

ToolJet versions prior to 3.16.208 are vulnerable to broken access control, allowing authenticated builder-role users to perform unauthorized database operations across tenant boundaries.

A vulnerability in the Administrative Servlet of Soarkey StudentManagement and 学生信息管理系统 allows remote attackers to bypass authorization via manipulation of the action argument in AdminDao.doGet.

WWBN AVideo is vulnerable to a Server-Side Request Forgery (SSRF) bypass in the isSSRFSafeURL function due to improper normalization of hex-encoded NAT64 addresses.

The MyHome Core plugin for WordPress is vulnerable to authentication bypass via insecure AJAX handlers, allowing unauthenticated attackers to hijack arbitrary user accounts.

An unauthenticated authentication bypass vulnerability in the SAML Single Sign On - SSO Login plugin allows attackers to overwrite the IdP signing certificate and forge administrative sessions.

An authorization bypass vulnerability in pac4j-oidc versions prior to 6.5.6 allows attackers to forge OIDC access tokens by exploiting the library's failure to validate token signatures, issuers, audiences, and expiration.

The Omnivore API improperly validates Apple sign-in tokens, allowing attackers to perform algorithm confusion attacks to bypass authentication and impersonate users.

IBM Administration Runtime Expert for i 1R1M0 contains an improper authentication enforcement vulnerability allowing a remote authenticated attacker to access sensitive information.

Gophish versions through 0.12.1 contain a vulnerability in the API authentication middleware that fails to enforce account lockout and password change requirements, allowing attackers with valid API keys to maintain persistent unauthorized access.

SpringBlade versions 2.7.3 through 3.5.0 allow authenticated attackers to forge administrative tokens using a hardcoded JWT signing key and escalate privileges via an unprotected internal endpoint.