CVE-2026-44476 is an improper authentication vulnerability in the doorkeeper-openid_connect gem version 1.9.0. It allows an attacker who knows a dynamically registered client's client_id to obtain an access token without providing the client_secret. This occurs because dynamically registered clients are incorrectly marked as non-confidential, causing the client_secret verification to be skipped. The issue affects only projects that have enabled Dynamic Client Registration, which is disabled by default. The vulnerability is fixed in version 1.10.0.
CVE-2026-68569 is an improper authentication vulnerability in Apache Tomcat affecting multiple versions from 7.0.0 through 11.0.24. The flaw allows authentication of users who do not exist in the DataSourceRealm under certain authentication methods such as CLIENT-CERT and SPNEGO. This could lead to unauthorized access. The issue has been fixed in Apache Tomcat versions 11.0.25, 10.1.58, and 9.0.121.
NVIDIA Unified Fabric Manager Enterprise - GA has a vulnerability in its web interface authorization component that allows an authenticated user to bypass proper authentication by sending specially crafted HTTP requests. Exploiting this flaw could lead to code execution and privilege escalation. The vulnerability is identified as CWE-287 (Improper Authentication) and has a high severity CVSS score of 8.8. No patch or official remediation has been confirmed yet.
PraisonAI versions prior to 4.6.58 have an improper authentication vulnerability where the create_auth_middleware() function allows unauthenticated requests if the API key or JWT secret is missing. This enables an externally accessible Recipe server to accept unauthenticated POST requests to /v1/recipes/run despite authentication being enabled. The issue is resolved in version 4.6.58.
An improper authentication vulnerability exists in Apache Hive versions 4.0.0 through 4.2.0 when using HiveServer2 with SAML authentication over HTTP transport. This flaw allows an unauthenticated attacker with network access to the HiveServer2 HTTP port to impersonate any Hive user by sending a forged Authorization: Bearer token to the /cliservice endpoint. No Hive credentials, SAML IdP login, or server signing secret knowledge is required. The vulnerability does not affect deployments where Apache Knox handles SSO and HiveServer2 uses LDAP or Kerberos authentication.
CVE-2026-65633 is an improper authentication vulnerability in the ash_authentication library by team-alembic. It allows purpose-limited JWT tokens, such as sign_in tokens, to be replayed as full bearer API credentials when stateless bearer-token verification is used without strict purpose checks. This bypasses intended one-time-use and revocation semantics, enabling an attacker with a valid sign_in token to authenticate as the token's subject. The issue affects versions from 3.10.5 before 4.14.2 and from 5.0.0-rc.0 before 5.0.0-rc.13. Resources configured with require_token_presence_for_authentication?: true or using session-based authentication are not affected.
FilamentPHP filament versions prior to 4.12.0 and 5.7.0 contain an improper authentication vulnerability that allows bypassing app-based multi-factor authentication when recovery codes are enabled. Email-based multi-factor authentication is not affected. The issue is fixed in versions 4.12.0 and 5.7.0.
CVE-2026-66908 is an improper authentication vulnerability in the Apache Camel Platform HTTP Main component affecting versions from 4.8.0 up to but not including 4.22.0. The issue arises because the JWT authentication configuration does not enforce validation of the issuer (iss) and audience (aud) claims unless explicitly configured, allowing acceptance of any unexpired token signed by a trusted key. This can lead to acceptance of tokens intended for other services or audiences within the same trust domain. The vulnerability is fixed in version 4.22.0, which requires explicit configuration of issuer and audience claims or an explicit override to allow missing claims. Users on maintenance branches 4.14.x and 4.18.x should upgrade to versions 4.14.9 or 4.18.4 and configure these claims accordingly.
The SmilePass Selfie Login WordPress plugin versions through 1.0.2 contain an improper authentication vulnerability. The plugin does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators. This vulnerability has a critical severity rating with a CVSS score of 9.8.
CVE-2026-77001 is a critical improper authentication vulnerability in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through version 1.2.0. The plugin fails to perform any authentication, authorization, or nonce checks in a publicly accessible login handler. This flaw allows unauthenticated attackers to obtain a valid session as any existing user, including the original administrator account, without needing any credentials.
WP Social Media Login plugin versions up to 1.0.6 contain an improper authentication vulnerability that allows attackers to bypass social login verification. An attacker can log in as any existing user, including administrators, by simply supplying the user's email address without completing authentication with the identity provider.
CVE-2026-76793 is a high-severity vulnerability in the Firebase Authentication WordPress plugin before version 1.7.1. The flaw allows unauthenticated attackers to log in as any user, including administrators, because the plugin does not verify the email address in an authentication token before matching it to a WordPress account and issuing a session.
ManageWP Worker WordPress plugin versions before 4.9.37 contain an improper authentication vulnerability. The plugin does not bind the logged-in account to the authorization signature and fails to prevent replay of used login links. This flaw allows attackers who obtain a valid login link to impersonate any user on the site, including administrators.
CVE-2025-15671 is an improper authentication vulnerability in the Welcart e-Commerce WordPress plugin versions before 2.12.1. The plugin fails to regenerate session identifiers upon authentication and allows setting the session ID from a user-supplied parameter. This enables an unauthenticated attacker to fixate a session for a shop member and potentially take over their customer account after the victim logs in via a crafted request.
CVE-2026-17142 is a critical improper authentication vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1. This flaw could allow a remote attacker to execute arbitrary commands without authentication. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the available data.
CVE-2026-17000 is a high-severity vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It involves improper authentication that could allow a remote attacker to execute arbitrary code. The vulnerability has a CVSS 3.1 score of 8.1, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
CVE-2026-16972 is an improper authentication vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to obtain sensitive information without proper authentication. The vulnerability has a medium severity rating with a CVSS score of 6.5.
BigBlueButton versions prior to 3.0.23 contain an improper authentication vulnerability in the handleJoinExistingUser API endpoint. This flaw allows an attacker who can supply an existingUserID of an active participant to reuse that participant's session and impersonate them within the same meeting. The issue arises because the handleJoinExistingUser action was publicly routable instead of being a private helper. This vulnerability is fixed in version 3.0.23.
CVE-2026-16857 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves improper authentication that could allow a remote attacker to manipulate network traffic and DNS configuration. The vulnerability has a CVSS 3.1 score of 8.2, indicating a significant risk. No patch or remediation information is provided in the available data.
Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the replacement secret from the response, calculate a valid code, and complete authentication without the victim's second factor. This issue is fixed in version 3.8.11.