CVE-2026-16686 is a high severity vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that involves improper authentication. This flaw could allow a remote attacker to access NFS-exported filesystems without proper authorization. The vulnerability has a CVSS 3.1 base score of 8.2, indicating a significant confidentiality impact. No patch or remediation information is currently provided.
CVE-2026-16656 is a critical improper authentication vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. This flaw could allow a remote attacker to gain root privileges without proper authentication.
A vulnerability in the SAML Single Sign On WordPress plugin before version 5.4.7 allows improper authentication due to failure to verify the signature of a SAML response before storing its certificate. This flaw enables an attacker to promote their own certificate to a trusted signing certificate with a single click, potentially allowing them to authenticate as any user, including administrators.
Membership For WooCommerce plugin versions before 3.1.2 have an authentication flaw where the plugin does not verify if an API consumer secret exists before comparing it to the request. This allows unauthenticated attackers to access REST API routes and disclose membership plan details of any user on sites with the API enabled but no keys generated.
CVE-2026-18031 is a critical improper authentication vulnerability in the TabaPay Gateway WordPress plugin up to version 1.4.0. The plugin fails to validate payment callbacks before establishing sessions, allowing unauthenticated attackers to log in as any registered user, including administrators.
TP-Link Tapo C120 v1 and C200 v5 devices have an improper authentication vulnerability in their login authentication verification module. This flaw allows a local network attacker to bypass authentication by exploiting weaknesses in challenge parameter validation. Successful exploitation grants administrative session tokens, enabling privileged management actions and unauthorized administrative access. The vulnerability can also cause temporary disruption of device services, leading to denial-of-service conditions.
CVE-2026-53958 is an improper authentication vulnerability in 4gaBoards prior to version 3.3.9. It allows an authenticated user to modify backend-managed single sign-on (SSO) identity attributes via a PATCH request to the user API. This flaw enables an attacker to associate a victim's SSO provider identifier with the attacker's account, causing the victim to be logged into the attacker-controlled account upon their first SSO login. The vulnerability is fixed in version 3.3.9.
4gaBoards versions prior to 3.3.8 have an improper authentication vulnerability that allows attackers to create unverified local accounts using a victim's email when multiple registration methods and SSO providers are enabled. This flaw enables attackers to link their local account to the victim's verified SSO identity without ownership verification, retaining password access and gaining unauthorized access to the victim's projects and data. The issue is resolved in version 3.3.8.
CVE-2026-73337 is a high-severity vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It involves an improper authentication flaw where insufficient state checks allow bypassing multi-factor authentication (MFA) protections. This vulnerability enables attackers to circumvent 2FA mechanisms, potentially gaining unauthorized access without completing the required authentication steps.
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using these two primitives, any website can make a authenticated cross-origin request to the UpTrain instance by providing the default API key in the header `uptrain-access-token`. This issue may allow arbitrary websites to perform privileged operations on the UpTrain instance, as if they were the default logged in user. As of time of publication, no known patches are available.
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters; when `ussync-key` references an unregistered slot, `get_option()` returns `false` for both the secret key and the domain list, causing the AES-256-CBC encryption key to degrade to the fully predictable `md5('')` and the referer allowlist to collapse to an empty-string match, while the AES IV is unconditionally hard-coded as `md5('another-secret')`. This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets.
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.
Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints due to unsanitized user input that can be passed through to the backend SQL database. The `nodeId` parameter can be modified to inject SQL commands, and the results are returned in error messages. Metacat appends the user-supplied data into the sql query without sanitization or parameterization. This allows extraction of arbitrary data from the underlying PostgresQL database, fully exposing protected information to the attacker. This is accomplished by leveraging the error reporting mechanisms in Metacat, where SQL error responses are mirrored back to the caller in the XML error message returned by Metacat. One approach, for example, is to use the PostgreSQL `CAST` function to generate an error with the results of an arbitrary subquery, which is then injected into the XML error message returned by Metacat. Attackers do not need to be authenticated to execute the attack. In addition, arbitrary SQL statements that insert, update, and delete data in the Metacat database can be executed, resulting in full compromise of all data in the database. Full proof of concept attacks have been developed and verified for these vulnerabilities. The impact of this vulnerability is critical for Metacat deployments in the DataONE network where information from the database can be exfiltrated, added, changed, or deleted. This includes management information about the data catalog, access log information about who accessed data, identifying information about individuals including their ORCID identifier and client IP address, access control information about who should be able to access and modify data, and other critical internals of the data system. This sql injection vulnerability was remediated fully in Metacat version 3.4.1. If upgrading to Metacat 3.4.1 isn't immediately possible, most deployments can mitigate the issue by disabling the `/cn` REST endpoints in the webapp deployment. This API is not needed or used by member repositories in the DataONE network, as it is only used by the DataONE Coordinating Node deployments. Consequently, this API can be disabled without reduction of functionality for most deployments. To disable the vulnerable endpoints, simply remove the servlet and servlet-mapping for the `/cn` endpoints in the servlet engine associated with the two servlets, `edu.ucsb.nceas.metacat.restservice.v1.CNRestServlet` and `edu.ucsb.nceas.metacat.restservice.v2.CNRestServlet`. For example, in Tomcat, remove the relevant `servlet-mapping` elements from the application web.xml file in Metacat.