CWE-306: Missing Authentication vulnerabilities

CVE-2026-86242 is a high-severity vulnerability in maximhq Bifrost HTTP transport versions before 2.0.0-prerelease3. It allows unauthenticated remote code execution when management authentication is disabled (the default setting). The flaw arises because Bifrost accepts a custom plugin path as an HTTP URL, downloads it, and dynamically loads it as a Go plugin, executing initialization code with the Bifrost process user privileges. This dynamic loading only succeeds on dynamically linked builds; statically linked Docker images are not vulnerable to RCE but may be susceptible to server-side request forgery. The vulnerability requires high attack complexity due to environment-specific plugin compatibility requirements. The 1.6.x line through 1.6.11 is also affected. No official patch or remediation link is provided in the data.

RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel. This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability due to missing authentication for critical functions. This flaw could allow a remote attacker to cause denial of service and impact data integrity. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.

CVE-2026-70352 is a critical vulnerability in Microsoft Azure AI Language Authoring where missing authentication for a critical function allows unauthorized attackers to elevate privileges over a network. This flaw affects the cloud service and has a CVSS score of 10. An official fix is available from Microsoft.

SEPPmail Secure Email Gateway versions before 15.0.7 have an improper authentication vulnerability where a fully privileged session is created before multi-factor authentication (MFA) enrollment is completed. This allows an attacker who knows the password of an MFA-required but unenrolled account to access protected functionality without providing the second factor.

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails.

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access.

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16.

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

Dell PowerStore 500T contains a critical vulnerability (CVE-2026-58574) involving missing authentication for a critical function. An unauthenticated attacker with network access to the restricted management interface could exploit this flaw to read internal system information from the appliance filesystem. This exposure could lead to disclosure of sensitive information and credentials, potentially allowing full administrative access to the storage array.

Arc, a SQL-native time-series database by Basekick-Labs, has an improper access control vulnerability in its Enterprise clustering feature. Versions from 26.02.1 up to but not including 26.06.2 allow unauthenticated cluster join requests when clustering is enabled but no shared secret is configured. This enables an attacker who knows the cluster name and can reach the coordinator port to join the cluster as a trusted node, manipulate cluster membership, intercept forwarded requests including authentication headers, and disrupt cluster operations. The default standalone configuration is not affected as clustering is disabled by default. The issue is fixed in version 26.06.2.

The Ebyte NA111-M firmware version 9013-2-17 contains a vulnerability where its vendor configuration utility does not require authentication for certain administrative actions if default credentials remain unchanged. This allows an unauthenticated attacker on the adjacent network to reboot the device or restore factory settings, resulting in loss of configuration and service availability.

CVE-2026-78239 is a critical vulnerability in the Xiiaozet LK100W device where a management function can be accessed remotely without authentication. This flaw allows an attacker to enable administrative services that should be restricted, potentially leading to unauthorized device access. The vulnerability has a CVSS score of 9.8, indicating a high severity with full confidentiality, integrity, and availability impact. No patch or official remediation guidance has been provided yet.

The Ebyte NA111-M firmware version 9013-2-17 contains a critical vulnerability (CVE-2026-73125) due to inconsistent enforcement of authentication in its web management interface. This allows unauthenticated remote attackers to access administrative functions, which may lead to exposure of sensitive configuration data, unauthorized modification of device settings, or disruption of device availability.