Tag
Fission Function Invocation Bypass via Public Router Endpoint
1 rule 1 TTPThe Fission router exposes the `/fission-function/<ns>/<name>` endpoint on its public listener, allowing invocation of any function without an HTTPTrigger, leading to unauthorized function access and potential cross-tenant exploitation; patched in v1.23.0.
Caddy Defender Client IP Bypass Vulnerability (CVE-2026-46415)
2 rules 1 TTPCaddy Defender versions before v0.10.1 are vulnerable to a client IP bypass (CVE-2026-46415) when deployed behind a trusted proxy, allowing blocked clients to bypass Defender's IP-based restrictions.
Fleet Windows MDM Azure AD JWT Authentication Bypass Vulnerability
2 rules 2 TTPs 1 IOCA vulnerability in Fleet versions prior to 4.82.0 allows authentication tokens from any Azure AD tenant to be accepted, enabling unauthorized device enrollment and MDM API access due to improper JWT signature validation, tracked as CVE-2026-24899.
Next.js Middleware Authorization Bypass via Dynamic Route Parameter Injection (CVE-2026-44574)
2 rules 1 TTPA vulnerability in Next.js (CVE-2026-44574) allows for authorization bypass in applications that use middleware to protect dynamic routes, enabling attackers to render protected content without proper authorization by crafting specific query parameters.
Clerk Authorization Bypass Vulnerability
2 rules 1 TTPClerk has an authorization bypass vulnerability in multiple packages where the `has()` and `auth.protect()` predicates can incorrectly return true, potentially allowing unauthorized actions.
Better Auth OAuth Provider Authorization Bypass Vulnerability
2 rules 2 TTPsAn authorization bypass vulnerability exists in Better Auth's OAuth provider, allowing low-privilege users to create OAuth clients despite configured clientPrivileges, potentially leading to unauthorized client registration and increased phishing risks.
@fastify/middie Middleware Bypass Vulnerability (CVE-2026-33804)
2 rules 1 TTP 1 CVEA middleware bypass vulnerability (CVE-2026-33804) exists in @fastify/middie versions 9.3.1 and earlier when the deprecated Fastify ignoreDuplicateSlashes option is enabled, potentially allowing unauthorized access.
Better Auth Two-Factor Authentication Bypass Vulnerability
2 rules 1 TTPBetter Auth versions prior to 1.4.9 have a critical two-factor authentication bypass vulnerability; when session.cookieCache is enabled, the initial sign-in session may be improperly cached, allowing attackers with valid credentials to bypass 2FA.
Moby Authorization Plugin Bypass via Oversized Request Bodies
2 rulesA vulnerability in Moby allows attackers to bypass authorization plugins by crafting API requests with oversized bodies, causing the Docker daemon to forward the request without the body to the plugin, potentially leading to unauthorized actions.
Claude Code Workspace Trust Dialog Bypass via Settings Loading Order (CVE-2026-33068)
2 rules 1 TTPA maliciously crafted `.claude/settings.json` file in a Claude Code repository (versions prior to 2.1.53) can bypass the workspace trust confirmation dialog by exploiting a configuration loading order defect, allowing for arbitrary code execution within a supposedly untrusted workspace.
MOTW Bypass via CAB, TAR, and 7-Zip Chaining
2 rules 2 TTPs 1 IOCA newly discovered Mark of the Web (MOTW) bypass technique utilizes a chain of CAB, TAR, and 7-Zip archives to circumvent SmartScreen and execute files without security warnings.
Credential Guard Bypass and Detection Strategies
2 rules 2 TTPs 1 IOCThis brief covers offensive techniques to bypass Credential Guard, a Windows security feature designed to protect credentials, and provides detection strategies for these bypass attempts.
Admidio Inverted 2FA Reset Allows Privilege Escalation
2 rules 2 TTPsA logic error in Admidio's two-factor authentication reset inverts the authorization check, allowing non-admin users to remove other users' TOTP, including administrators, reducing their security to password-only authentication in versions 5.0.8 and earlier.
Suspicious PowerShell TabExpansion Direct Call
2 rules 2 TTPsThis detection identifies PowerShell scripts that directly call the TabExpansion internal function, which is uncommon and may indicate malicious activity, such as TabShell, potentially bypassing sandboxes by loading PowerShell functions via directory traversal.
GitHub Enterprise IP Allow List Disabled
2 rules 1 TTPAn IP allow list was disabled in GitHub Enterprise, potentially allowing unauthorized access from untrusted networks and exposing sensitive code repositories.