SEPPmail Secure Email Gateway versions before 15.0.7 have an improper authentication vulnerability where a fully privileged session is created before multi-factor authentication (MFA) enrollment is completed. This allows an attacker who knows the password of an MFA-required but unenrolled account to access protected functionality without providing the second factor.
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `wp_set_auth_cookie()` to be called for that administrator, granting the attacker full administrative access to the WordPress site.
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4.
CVE-2026-49003 is a critical improper authentication vulnerability in ZTE ZXDU68 S202 V5.0. Attackers exploiting this flaw can perform command injection to delete core system runtime files, causing the monitoring module to crash. They can also gain root privileges to steal configuration passwords such as SNMP, tamper with critical system parameters, and disrupt the operation of the entire power system.
The SAML Single Sign On – SSO Login plugin for WordPress contains an authentication bypass vulnerability in versions up to and including 5.4.6. This flaw allows unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with a malicious value, enabling them to forge SAML assertions and gain fully privileged sessions, including administrator access. Exploitation requires the administrator to perform a repair after encountering a specific error during test configuration.
User Profile Builder WordPress plugin versions 3.8.1 and prior do not properly restrict front-end file upload functionality. This flaw allows unauthenticated users to list the site's media library and modify unpublished posts, pages, and media items of other users. The vulnerability is classified as CWE-287 (Improper Authentication) and has a high severity score of 8.2. No official patch or remediation guidance is currently available.
IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authentication vulnerability that could allow a remote attacker to execute arbitrary flows and access sensitive information without proper authorization. This vulnerability is identified as CWE-287 and has a high severity rating with a CVSS score of 8.2. No official patch or remediation guidance has been provided by the vendor as of the published date.
CVE-2026-17203 is a high severity vulnerability in IBM Administration Runtime Expert for i version 1R1M0. It involves improper authentication enforcement that could allow a remote unauthenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Arc, a SQL-native time-series database by Basekick-Labs, has an improper access control vulnerability in its Enterprise clustering feature. Versions from 26.02.1 up to but not including 26.06.2 allow unauthenticated cluster join requests when clustering is enabled but no shared secret is configured. This enables an attacker who knows the cluster name and can reach the coordinator port to join the cluster as a trusted node, manipulate cluster membership, intercept forwarded requests including authentication headers, and disrupt cluster operations. The default standalone configuration is not affected as clustering is disabled by default. The issue is fixed in version 26.06.2.
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
A critical vulnerability exists in the WebSocket endpoint of gpt-researcher version 0.14.7 and earlier. This flaw allows an unauthenticated remote attacker to execute arbitrary code by sending malicious Model Context Protocol configurations. The vulnerability is identified as CVE-2026-37006 and has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided. There are no known exploits in the wild at this time.
Dell PowerProtect Cyber Recovery versions prior to 20.3 contain an improper authentication vulnerability (CWE-287). This flaw could allow a low privileged attacker with remote access to gain unauthorized access. The vulnerability has a high severity with a CVSS score of 7.6, indicating significant impact on confidentiality and integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-47841 is a high severity vulnerability in Spring Security's WebAuthn support that may allow user verification bypass when using a distributed HTTP session store. It affects multiple versions of Spring Security including 6.4.x, 6.5.x, 7.0.x, and 7.1.0. The vulnerability relates to improper authentication (CWE-287). No official patch or remediation guidance is currently confirmed.
CVE-2026-19718 is a high-severity vulnerability affecting the BlogVault Backup & Staging WordPress plugin version 5.16 and related plugins before version 6.65. It involves improper authentication where unauthenticated users can access data derived from a secret that links a site to its remote management service. The secret is generated using a weak pseudo-random number generator, enabling attackers to recover it and gain administrative access to the site.
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.