https://poc.intelseclab.com/tags/auth-bypass/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-34910-unifi-os-unauth-rce/Critical severity (CVSS 10) — network · CVE-2026-34910, CVE-2026-34909, CVE-2026-34908. Status: Patched. Affects: Ubiquiti UniFi OS Server. Tags: ubiquiti, unifi, unifi-os, auth-bypass, path-traversal, command-injection, rce, unauth, kev, mirai, nginx, CVE-2026-34910.networkCriticalubiquitiunifiunifi-osauth-bypasspath-traversalcommand-injectionrceunauthkevmirainginxCVE-2026-34910https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-09_cve-2025-61882-oracle-ebs-preauth-rce/Critical severity (CVSS 9.8) — web · CVE-2025-61882 (Oracle Security Alert, out-of-band, October 2025). Status: Patched (Oracle out-of-band Security Alert, October 2025). Affects: Oracle E-Business Suite — Oracle Concurrent Processing product, BI Publisher Integration component (reached via the /OA_HTML/ web tier: configurator/UiServlet and ieshostedsurvey.jsp). Tags: oracle-ebs, oracle-concurrent-processing, bi-publisher-integration, pre-auth, rce, ssrf, crlf-injection, request-smuggling, path-traversal, auth-bypass, xslt, java, cisa-kev, ransomware, cl0p, watchtowr.webCriticaloracle-ebsoracle-concurrent-processingbi-publisher-integrationpre-authrcessrfcrlf-injectionrequest-smugglingpath-traversalauth-bypassxsltjavacisa-kevransomwarecl0pwatchtowrhttps://poc.intelseclab.com/pocs/hardware/2026-07-06_cve-2025-65856-onvif-camera-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-06_cve-2025-65856-onvif-camera-auth-bypass/Critical severity (CVSS 9.8) — hardware · CVE-2025-65856. Status: Weaponized. Affects: Xiongmai XM530-based IP camera ONVIF service (tested on model XM530_50X50-WG_8M). Tags: xiongmai, xm530, onvif, ip-camera, iot, auth-bypass, access-control, information-disclosure, rtsp, cwe-306, cwe-287, python, bash, curl.hardwareCriticalxiongmaixm530onvifip-cameraiotauth-bypassaccess-controlinformation-disclosurertspcwe-306cwe-287pythonbashcurlhttps://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-13315-twonky-server-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-13315-twonky-server-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-13315. Status: PoC. Affects: Twonky Server (Lynx Technology), a DLNA/UPnP media server. Tags: twonky-server, dlna, upnp, media-server, auth-bypass, access-control, information-disclosure, credential-leak, cwe-284, unauthenticated, nuclei.networkCriticaltwonky-serverdlnaupnpmedia-serverauth-bypassaccess-controlinformation-disclosurecredential-leakcwe-284unauthenticatednucleihttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-58434-flowise-auth-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-58434-flowise-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2025-58434. Status: Weaponized. Affects: FlowiseAI (/api/v1/account/forgot-password and /api/v1/account/reset-password endpoints). Tags: flowiseai, auth-bypass, account-takeover, forgot-password, reset-password, api, python, cwe-640.webCriticalflowiseaiauth-bypassaccount-takeoverforgot-passwordreset-passwordapipythoncwe-640https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34472-zte-h188a-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34472-zte-h188a-auth-bypass/Critical severity — network · CVE-2026-34472. Status: PoC. Affects: ZTE ZXHN H188A V6 home router firmware. Tags: router, firmware, unauthenticated, auth-bypass, credential-leak, iot, zte, wifi.networkCriticalrouterfirmwareunauthenticatedauth-bypasscredential-leakiotztewifihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5415-wp-captcha-pro-auth-bypass/High severity (CVSS 8.8) — web · CVE-2026-5415. Status: PoC. Affects: WP Captcha PRO (WordPress plugin, Advanced Google reCAPTCHA). Tags: wordpress, wp-captcha-pro, auth-bypass, privilege-escalation, nonce, ajax, account-takeover, plugin.webHighwordpresswp-captcha-proauth-bypassprivilege-escalationnonceajaxaccount-takeoverpluginhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-12416-wp-password-reset-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-12416, CVE-2026-12417. Status: Weaponized. Affects: SignUp & SignIn WordPress plugin (CVE-2026-12417); Invoice Generator WordPress plugin (CVE-2026-12416). Tags: wordpress, wp-plugin, account-takeover, password-reset, auth-bypass, ajax, mass-exploitation.webCriticalwordpresswp-pluginaccount-takeoverpassword-resetauth-bypassajaxmass-exploitationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0001-smartermail-password-reset/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-0001-smartermail-password-reset/Critical severity (CVSS 9) — web · CVE-2026-0001 (tracked publicly as WT-2026-0001). Status: PoC. Affects: SmarterTools SmarterMail (webmail/admin control panel), typically on port 9998. Tags: smartermail, auth-bypass, password-reset, email-server, unauthenticated, rce-chain, smartertools, api.webCriticalsmartermailauth-bypasspassword-resetemail-serverunauthenticatedrce-chainsmartertoolsapihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48558-simplehelp-oidc-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-48558-simplehelp-oidc-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-48558. Status: PoC. Affects: SimpleHelp remote support / remote monitoring & management (RMM) server, OIDC authentication flow. Tags: simplehelp, oidc, jwt, alg-none, auth-bypass, rmm, remote-support, cisa-kev.webCriticalsimplehelpoidcjwtalg-noneauth-bypassrmmremote-supportcisa-kevhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-29000. Status: Weaponized. Affects: pac4j (JWT authentication module), used in Java web applications. Tags: pac4j, jwt, jwe, auth-bypass, alg-none, jwks, privilege-escalation, java.webCriticalpac4jjwtjweauth-bypassalg-nonejwksprivilege-escalationjavahttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-28466-openclaw-gateway-websocket-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-28466-openclaw-gateway-websocket-rce/Critical severity — network · CVE-2026-28466. Status: Weaponized. Affects: OpenClaw gateway. Tags: openclaw, websocket, rce, gateway, auth-bypass, node-invoke, command-injection.networkCriticalopenclawwebsocketrcegatewayauth-bypassnode-invokecommand-injectionhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-24207-triton-sagemaker-auth-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-24207-triton-sagemaker-auth-bypass-rce/Critical severity (CVSS 9.8) — network · CVE-2026-24207 (sibling: CVE-2026-24206, Vertex AI, analysis only). Status: Weaponized. Affects: NVIDIA Triton Inference Server. Tags: nvidia-triton, sagemaker, auth-bypass, rce, cwe-288, ml-inference, model-loading, pre-auth.networkCriticalnvidia-tritonsagemakerauth-bypassrcecwe-288ml-inferencemodel-loadingpre-authhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30849-mantisbt-soap-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30849-mantisbt-soap-auth-bypass/High severity — web · CVE-2026-30849. Status: Weaponized. Affects: MantisBT (SOAP API). Tags: mantisbt, soap, auth-bypass, type-juggling, php, bug-tracker, typescript.webHighmantisbtsoapauth-bypasstype-jugglingphpbug-trackertypescripthttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49468-litellm-host-header-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49468-litellm-host-header-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-49468. Status: PoC. Affects: LiteLLM (BerriAI) proxy. Tags: litellm, llm-proxy, auth-bypass, host-header, route-confusion, cwe-290, fastapi, starlette, python.webCriticallitellmllm-proxyauth-bypasshost-headerroute-confusioncwe-290fastapistarlettepythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27771-gitea-registry-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27771-gitea-registry-auth-bypass/Critical severity — web · CVE-2026-27771. Status: Weaponized. Affects: Gitea (self-hosted Git service with OCI container registry). Tags: gitea, forgejo, oci-registry, auth-bypass, container-registry, unauthenticated, information-disclosure.webCriticalgiteaforgejooci-registryauth-bypasscontainer-registryunauthenticatedinformation-disclosurehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30824-flowise-nvidia-nim-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30824-flowise-nvidia-nim-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-30824. Status: Weaponized. Affects: Flowise (NVIDIA NIM integration endpoints). Tags: flowise, nvidia-nim, auth-bypass, cwe-306, token-theft, container-management, python, unauthenticated.webCriticalflowisenvidia-nimauth-bypasscwe-306token-theftcontainer-managementpythonunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-31816-budibase-auth-bypass-rce/Critical severity — web · CVE-2026-31816. Status: Weaponized. Affects: Budibase (low-code platform). Tags: budibase, auth-bypass, rce, plugin-upload, reverse-shell, low-code, python, datasource-plugin.webCriticalbudibaseauth-bypassrceplugin-uploadreverse-shelllow-codepythondatasource-pluginhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-43515-tomcat-constraint-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-43515-tomcat-constraint-bypass/High severity — web · CVE-2026-43515. Status: PoC. Affects: Apache Tomcat — org.apache.catalina.realm.RealmBase.findSecurityConstraints(). Tags: apache-tomcat, java, security-constraint, auth-bypass, realm-base, servlet, web-xml, access-control.webHighapache-tomcatjavasecurity-constraintauth-bypassrealm-baseservletweb-xmlaccess-controlhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29145-tomcat-mtls-ocsp-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29145-tomcat-mtls-ocsp-bypass/Critical severity (CVSS 9.1) — web · CVE-2026-29145. Status: PoC. Affects: Apache Tomcat (CLIENT_CERT / Mutual TLS authentication). Tags: tomcat, mtls, client-cert, ocsp, auth-bypass, revocation-check, docker-lab, java.webCriticaltomcatmtlsclient-certocspauth-bypassrevocation-checkdocker-labjavahttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30498-adminpanel-csrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30498-adminpanel-csrf/High severity — web · CVE-2026-30498 (reserved by MITRE). Status: PoC. Affects: AdminPanel 4.0 (archived project). Tags: csrf, php, file-deletion, auth-bypass, setup-mode, get-request, adminpanel.webHighcsrfphpfile-deletionauth-bypasssetup-modeget-requestadminpanelhttps://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-0257-pan-os-globalprotect-auth-bypass/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-0257-pan-os-globalprotect-auth-bypass/High severity (CVSS 7.8) — web · CVE-2026-0257. Status: PoC. Affects: Palo Alto Networks PAN-OS — GlobalProtect portal and gateway (also affects certain Prisma Access deployments). Tags: auth-bypass, VPN, GlobalProtect, PAN-OS, Palo-Alto, certificate-bypass, cookie-forgery, Prisma-Access, unauthenticated.webHighauth-bypassVPNGlobalProtectPAN-OSPalo-Altocertificate-bypasscookie-forgeryPrisma-Accessunauthenticatedhttps://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-10520-ivanti-sentry-rce/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-10520-ivanti-sentry-rce/Critical severity (CVSS 10) — network · CVE-2026-10520, CVE-2026-10523. Status: PoC. Affects: Ivanti Sentry (formerly MobileIron Sentry). Tags: pre-auth, RCE, OS-command-injection, Ivanti, Sentry, MICS-API, auth-bypass, admin-creation, CISA-KEV.networkCriticalpre-authRCEOS-command-injectionIvantiSentryMICS-APIauth-bypassadmin-creationCISA-KEVhttps://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-50751-checkpoint-ikev1-bypass/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-06-28_cve-2026-50751-checkpoint-ikev1-bypass/Critical severity (CVSS 9.3) — network · CVE-2026-50751. Status: PoC. Affects: Check Point Remote Access VPN / Mobile Access / Spark Firewall. Tags: auth-bypass, VPN, IKEv1, Check-Point, Remote-Access, certificate-bypass, Qilin, ransomware, CISA-KEV, unauthenticated.networkCriticalauth-bypassVPNIKEv1Check-PointRemote-Accesscertificate-bypassQilinransomwareCISA-KEVunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_toolshell-sharepoint-chain/Critical severity — web · CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706. Status: Weaponized. Affects: Microsoft SharePoint Server. Tags: RCE, SharePoint, unauthenticated, deserialization, auth-bypass, APT27, APT31, ransomware, Windows, IIS.webCriticalRCESharePointunauthenticateddeserializationauth-bypassAPT27APT31ransomwareWindowsIIShttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-dynamic-route-injection-auth-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-dynamic-route-injection-auth-bypass/High severity (CVSS 8.1) — web · CVE-2026-44574. Status: Weaponized. Affects: Next.js App Router with dynamic route segments and middleware-based access control. Tags: auth-bypass, dynamic-route, nxtP-injection, middleware-bypass, param-smuggling, Next.js, App-Router, unauthenticated.webHighauth-bypassdynamic-routenxtP-injectionmiddleware-bypassparam-smugglingNext.jsApp-Routerunauthenticatedhttps://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-59718, CVE-2025-59719 (Advisory: FG-IR-25-647). Status: Weaponized. Affects: Fortinet FortiOS, FortiProxy, FortiSwitchManager (FortiCloud SSO feature). Tags: auth-bypass, SAML, SSO, unauthenticated, FortiOS, FortiProxy, FortiSwitchManager, active-exploitation.networkCriticalauth-bypassSAMLSSOunauthenticatedFortiOSFortiProxyFortiSwitchManageractive-exploitationhttps://poc.intelseclab.com/pocs/network/2026-05-16_vmware-esxi-ad-auth-bypass/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-16_vmware-esxi-ad-auth-bypass/Medium severity (CVSS 6.8) — network · CVE-2024-37085. Status: Weaponized. Affects: VMware ESXi hosts joined to Microsoft Active Directory. Tags: auth-bypass, Active Directory, ESXi, vCenter, ransomware, unauthenticated-esxi.networkMediumauth-bypassActive DirectoryESXivCenterransomwareunauthenticated-esxihttps://poc.intelseclab.com/pocs/web/2026-05-16_pan-os-management-auth-bypass/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_pan-os-management-auth-bypass/Critical severity (CVSS 9.1) — web · CVE-2025-0108. Status: Weaponized. Affects: Palo Alto Networks PAN-OS management web interface. Tags: auth-bypass, path-traversal, PAN-OS, Palo Alto, management-interface, unauthenticated.webCriticalauth-bypasspath-traversalPAN-OSPalo Altomanagement-interfaceunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-16_fortios-fortiproxy-auth-bypass-cve-2024-55591/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_fortios-fortiproxy-auth-bypass-cve-2024-55591/Critical severity (CVSS 9.6) — web · CVE-2024-55591 (Fortinet FG-IR-24-535). Status: Weaponized — public PoC exploit code available, listed in CISA KEV (added 2025-01-14), confirmed used in ransomware intrusions. Affects: Fortinet FortiOS/FortiProxy management interfaces. Tags: auth-bypass, websocket, race-condition, FortiOS, FortiProxy, unauthenticated, super-admin, kev, known-ransomware-use, cwe-288.webCriticalauth-bypasswebsocketrace-conditionFortiOSFortiProxyunauthenticatedsuper-adminkevknown-ransomware-usecwe-288https://poc.intelseclab.com/pocs/web/2026-05-16_cpanel-whm-auth-bypass-crlf-session-injection/Sat, 16 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-16_cpanel-whm-auth-bypass-crlf-session-injection/Critical severity (CVSS 10) — web · CVE-2026-41940. Status: Weaponized. Affects: cPanel & WHM. Tags: auth-bypass, CRLF-injection, session-poisoning, cPanel, WHM, unauthenticated.webCriticalauth-bypassCRLF-injectionsession-poisoningcPanelWHMunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-15_nextjs-middleware-bypass-cve-2025-29927/Fri, 15 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-15_nextjs-middleware-bypass-cve-2025-29927/Critical severity (CVSS 9.1) — web · CVE-2025-29927. Status: Weaponized. Affects: Next.js (Vercel). Tags: auth-bypass, middleware-bypass, Next.js, unauthenticated, header-injection.webCriticalauth-bypassmiddleware-bypassNext.jsunauthenticatedheader-injection