tag
Authentication-Bypass
Ivanti Endpoint Manager Mobile (EPMM) Unauthenticated Remote API Access (CVE-2023-35078)
Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core) fails to enforce authentication on specific paths beneath its /mifs/aad/api/ administrative API. An unauthenticated remote attacker can issue a plain GET…
Check Point Security Management / Multi-Domain Server SmartConsole Authentication Bypass via Forged Application Certificate Bind (CVE-2026-16232)
CVE-2026-16232 is an unauthenticated authentication bypass (CWE-287) in the Check Point SmartConsole login path on Security Management and Multi-Domain Management servers. During the legacy SIC/CPMI bootstrap the management server volunteers its own SIC…
CVE-2022-40684 — FortiOS / FortiProxy / FortiSwitchManager Authentication Bypass (vamp-forticheck Scanner)
CVE-2022-40684 is an authentication-bypass vulnerability in the web management interface of FortiOS, FortiProxy, and FortiSwitchManager that allows an unauthenticated remote attacker to access the administrative REST API. The affected firmware fails to…
SimpleHelp OIDC Authentication Bypass via Unverified JWT Signature (CVE-2026-48558)
When OIDC (OpenID Connect) authentication is configured on a SimpleHelp server, the server accepts identity tokens (JWTs) submitted during login without verifying their cryptographic signature. A remote, unauthenticated attacker can forge a token containing…
Flowise Enterprise Authentication Bypass via Hardcoded Default JWT Secrets (CVE-2026-56271)
Flowise's enterprise passport authentication middleware signs and verifies JWTs using values pulled from environment variables (JWTAUTHTOKENSECRET, JWTREFRESHTOKENSECRET, JWTAUDIENCE, JWTISSUER). When an operator doesn't set these — an easy oversight in a…
Gitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896)
Gitea supports reverse-proxy authentication: put it behind a proxy that sets an X-WEBAUTH-USER header, and Gitea trusts that header for the username, gated by REVERSEPROXYTRUSTEDPROXIES — an IP allowlist meant to ensure only the actual proxy can set that…
WP Directory Kit Auto-Login Authentication Bypass to Full Site Takeover (CVE-2025-13390)
WP Directory Kit implements a one-click "auto-login" feature via wdkgenerateautologinlink() that mints a login token from weak, predictable inputs (derived from the target user ID) rather than a cryptographically random secret. Because the token can be…
WordPress Simple Link Directory Unauthenticated Password Reset to Admin Takeover (CVE-2025-49901)
The Simple Link Directory plugin's qc-opd (password reset) AJAX/form handler accepts a username and a new password and applies it to the corresponding WordPress account without verifying the requester's identity via any token tied to the user, email…
WordPress Service Finder Bookings ≤ 6.0 Authentication Bypass via `original_user_id` Cookie (CVE-2025-5947)
The Service Finder Bookings WordPress plugin implements a "switch back to original user" feature (intended for admin-to-user account switching) via the servicefinderswitchback() AJAX handler, registered under the servicefinderswitchback action. This handler…
WordPress Mobile Builder Plugin JWT Authentication Bypass to Admin Account Creation (CVE-2025-68860)
The WordPress "Mobile Builder" plugin (<= 1.4.2) implements its own JWT-based authentication scheme for its REST API integration but signs/validates tokens using a static, publicly known secret (examplekey) rather than a per-site secret. Because the signing…
SmarterMail Auth Bypass via Password Reset to Pre-Auth RCE (CVE-2025-52691 / WT-2026-0001)
This PoC chains two SmarterMail vulnerabilities into a single pre-authentication-to-RCE exploit. First (WT-2026-0001), the /api/v1/auth/force-reset-password endpoint accepts a password-reset request that sets a new password for an arbitrary (including…
RustFS Hardcoded gRPC Authentication Token Leading to Full Node Compromise (CVE-2025-68926)
RustFS's internal cluster/node gRPC service (nodeservice.NodeService) authenticates peer-to-peer RPC calls using a fixed, hardcoded bearer token — the literal string "rustfs rpc" — which is compiled into every RustFS build and cannot be rotated or configured…
RestroPress WordPress Plugin Unauthenticated Information Exposure Leading to JWT Forgery / Account Takeover (CVE-2025-9209)
RestroPress, a WordPress food-ordering plugin, exposes user account metadata through the default wp-json/wp/v2/users REST endpoint, including private fields such as rpapiuserprivatekey, rpapiuserpublickey, and rpapiusertokenkey. These values are sensitive…
Oracle Identity Manager `;.wadl` Authentication Bypass + Groovy Script RCE (CVE-2025-61757)
Oracle Identity Manager's SecurityFilter fails to correctly normalize request URIs before applying its authentication check. By appending a ;.wadl matrix-parameter suffix to the path of the groovyscriptstatus endpoint, an unauthenticated attacker can bypass…
Mitel MiCollab Path Normalization Bypass to Internal Endpoints (CVE-2025-52913)
Mitel MiCollab fails to properly normalize URL paths before applying access-control checks on its NPM (Network Protocol Manager) web endpoints. By appending crafted traversal sequences such as ..;/..;/ after seemingly-legitimate, unauthenticated-facing…
JAY Login & Register "Switch Back" Cookie Authentication Bypass (CVE-2025-14440)
The JAY Login & Register plugin implements a "switch back" feature — presumably intended for admins who impersonate another user to later switch back to their own account — via the jayloginregisterprocessswitchback handler. This handler trusts the…
Gladinet CentreStack / Triofox Hardcoded AES Key Access-Ticket Forgery to Arbitrary File Read (CVE-2025-14611)
CentreStack and Triofox protect file-download "access tickets" with AES-256-CBC, but the encryption key and IV are not generated per-installation — they are static byte strings hardcoded in GladCtrl64.dll's .data section and returned verbatim by the…
FreePBX Framework Module Authentication Bypass via Forged Authorization Header (CVE-2025-66039)
CVE-2025-66039 is a critical authentication bypass in the FreePBX framework module that occurs when the system's "Authorization Type" (AUTHTYPE) is configured to webserver — in this mode FreePBX trusts an externally-supplied Authorization header (intended for…
FortiWeb `cgi-bin/fwbcgi` Path Traversal Authentication Bypass Leading to Rogue Admin Creation (CVE-2025-64446)
FortiWeb exposes an internal CGI handler (cgi-bin/fwbcgi) that is reachable through the authenticated cmdb REST API path by appending a relative path-traversal sequence (../) after a request to a nonexistent object (admin%3f). Because path handling for the…
FortiOS/FortiProxy/FortiSwitchManager/FortiWeb FortiCloud SSO Authentication Bypass Detection Tool (CVE-2025-59718)
CVE-2025-59718 is an improper verification of a cryptographic signature in Fortinet's FortiCloud SSO admin-login flow across FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb, allowing authentication bypass when admin-forticloud-sso-login is enabled on a…
CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309)
CrushFTP's web interface trusts the presence of the HTTP headers X-DMZ-Proxy: disabled and X-AS2-Version: 1.0 (plus a matching User-Agent) as proof that a request originates from an already-authenticated AS2 (Applicability Statement 2 / EDI-over-HTTP) proxy…
Apache mod_ssl TLS 1.3 Session Resumption Client Certificate Bypass (CVE-2025-23048)
CVE-2025-23048 is a client certificate authentication bypass in Apache HTTP Server's modssl that occurs when TLS 1.3 session resumption (session tickets/PSK) is used across virtual hosts configured with different SSLCACertificateFile directives. The root…
Apache Druid Kerberos Cookie-Signing Secret Recovery via ThreadLocalRandom Seed Inversion (CVE-2025-59390)
When Apache Druid's Kerberos authenticator is deployed without an explicit druid.auth.authenticator.kerberos.cookieSignatureSecret, Druid falls back to generating that secret using Java's ThreadLocalRandom, which is not cryptographically secure. Because…
YAMCS LdapAuthModule LDAP Injection Authentication Bypass (CVE-2026-42568)
YAMCS's LdapAuthModule builds LDAP search filters by directly substituting the user-supplied username into a filter template (e.g. (uid={0})) without RFC 4515 escaping. An attacker can supply LDAP metacharacters in the username field to alter the filter's…
SmarterMail Admin Password-Reset Authentication Bypass (CVE-2026-23760)
SmarterMail's force-reset-password API endpoint accepts anonymous requests and never validates the caller's existing password or a reset token before changing the password of a system administrator account. By POSTing a JSON body that names an existing admin…
Rack::Session::Cookie Decrypt-Failure Fallback to Unencrypted Cookies (CVE-2026-39324)
Rack::Session::Cookie, when configured with the secrets: option for encrypted session cookies, is supposed to reject any cookie that fails decryption. Instead, when all configured encryptors fail to decrypt a cookie, the code silently falls through to the…
Nextcloud user_oidc ID4me JWT Signature Bypass (CVE-2026-45156)
Nextcloud's useroidc app processes JWT idtoken values received from ID4me identity providers by splitting the token on . and calling base64decode() on the header and payload segments — but never validates the cryptographic signature (Id4meController.php lines…
LiteLLM Authentication Bypass via OIDC Userinfo Cache Key Collision (CVE-2026-35030)
LiteLLM's OIDC userinfo cache uses only the first 20 characters of the presented JWT (token[:20]) as its cache key. Two different, validly-signed JWTs can be crafted to share identical first-20-character prefixes, allowing an unauthenticated attacker to forge…
Keycloak Unauthorized Organization Registration via Invitation Token Flaw — CVE-2026-1529
Keycloak's organization invitation flow accepts a JWT invitation token to scope a new user's registration to a specific organization, but the server does not properly validate that the token's claims (notably the organization ID) have not been tampered with…
JeecgBoot mLogin Endpoint CAPTCHA Bypass Enabling Credential Brute Force (CVE-2026-8196)
JeecgBoot exposes a secondary login endpoint, /sys/mLogin, that accepts the same username/password credentials as the standard /sys/login endpoint but — unlike /sys/login — does not enforce a CAPTCHA challenge and applies no rate limiting or account lockout.…
HPE Aruba AOS-CX Pre-Auth REST API Bypass via nginx Version Smuggling (CVE-2026-23813)
AOS-CX fronts its management REST API with nginx, which uses an over-permissive regular expression to route requests by API version/login path. By smuggling a login-flavored token into the request path, an unauthenticated attacker can reach REST endpoints…
Hippoo Mobile App for WooCommerce — Unauthenticated Admin Account Takeover (CVE-2026-10580)
The Hippoo Mobile App for WooCommerce plugin registers a REST API endpoint (wc-hippoo/v1/ext/wp/v2/users/<id>) that proxies to WordPress's user-management REST routes but fails to properly enforce the underlying capability checks, conflating its own…
GNU inetutils telnetd Local Privilege Escalation via NEW-ENVIRON Injection — CVE-2026-28372
GNU inetutils telnetd forwards client-controlled environment variables — negotiated via the Telnet NEW-ENVIRON option — to the login(1) process it spawns without adequately sanitizing them. On systems where the installed login (from util-linux) supports a…
Form Notify WordPress Plugin — LINE OAuth Authentication Bypass to Account Takeover (CVE-2026-5229)
The Form Notify WordPress plugin's LINE Login OAuth callback resolves the local WordPress account to log into purely by matching an email address, without ever verifying that the connecting LINE account was previously linked to that WordPress user. In…
diskover-community — CSRF Leading to Authentication Bypass (CVE-2026-38934)
public/settingsprocess.php in diskover-community (<= 2.3.5) accepts sensitive configuration-changing POST requests without validating any CSRF token. An attacker can craft a self-submitting HTML form that, when opened by an authenticated administrator,…
CodeAstro Simple Attendance Management System 1.0 — SQL Injection Auth Bypass (CVE-2026-37749)
The login form in index.php of CodeAstro Simple Attendance Management System 1.0 concatenates the username POST parameter directly into a MySQL query with no sanitization or prepared statements. An unauthenticated attacker can submit a classic SQL injection…
Cisco Catalyst SD-WAN Peering Authentication Bypass — CVE-2026-20182
Cisco Catalyst SD-WAN Controller and Manager rely on a peering authentication handshake between fabric control-plane devices over DTLS on UDP port 12346, handled by the vdaemon process. A flaw in how this control-connection handshake enforces peering…
Burst Statistics WordPress Plugin Authentication Bypass to Admin Account Takeover (CVE-2026-8181)
Burst Statistics' ismainwpauthenticated() function (in class-mainwp-proxy.php) checks whether wpauthenticateapplicationpassword() returned a WPError, but does not verify that it returned an actual WPUser. When the call is made outside WordPress's normal REST…
Apache HTTP Server mod_auth_digest Timing Attack — CVE-2026-33006
Apache's modauthdigest module is vulnerable to a timing side-channel during HTTP Digest authentication: because the response verification does not run in constant time, an attacker can measure subtle differences in server response latency to infer whether a…
Apache APISIX forward-auth CRLF Header Injection — CVE-2026-31908
Apache APISIX's forward-auth plugin fails to sanitize CRLF (\r\n) sequences in inbound request headers before forwarding an authentication check upstream. By injecting CRLF sequences into headers such as Authorization, X-Forwarded-For, or Host, an…
Apache Airflow AWS Auth Manager SAML Host Header Injection (CVE-2026-25604)
CVE-2026-25604 is a CWE-346 origin validation error in Apache Airflow's AWS Auth Manager. When building the SAML AssertionConsumerService (ACS) callback URL for a login request, the code reads the HTTP Host header directly from the incoming request instead of…
AdForest WordPress Theme OTP Login Authentication Bypass — CVE-2026-1729
The AdForest WordPress theme implements a one-time-password (OTP) login flow via the sbloginuserwithotpfun AJAX handler, but the handler does not actually verify the submitted OTP code against a server-issued value before authenticating the requested user. As…
NodeBB ActivityPub attributedTo Local UID Spoof
NodeBB's ActivityPub inbox authenticates the top-level signed actor of an incoming activity via HTTP Signatures, but never checks that the embedded Note.attributedTo field — used later as the internal local user id for chat message and post authorship —…
Fortinet FortiClient EMS Pre-Auth Bypass — "FortiBleed" (CVE-2026-35616)
CVE-2026-35616 is a pre-authentication bypass in Fortinet FortiClient EMS's certificate-chain authentication handler (certchainauth.py), which trusts the X-SSL-CLIENT-VERIFY header directly without performing real cryptographic validation of the presented…
libcurl mTLS Connection Reuse Authentication Bypass (CVE-2026-8932)
CVE-2026-8932 is a Low-severity authentication bypass in libcurl's TLS connection reuse logic. Certain mTLS private-key configuration parameters (key file path, key type, key password) were omitted from the connection-matching comparison performed when…
GNU Inetutils telnetd Unauthenticated Root RCE via NEW-ENVIRON (CVE-2026-24061)
CVE-2026-24061 is a critical authentication bypass in GNU Inetutils telnetd that grants an unauthenticated network attacker an immediate root shell. The NEW-ENVIRON Telnet option handler passes the USER environment variable unsanitised to /bin/login. Setting…