CWE-287: Improper Authentication vulnerabilities

The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

The SMS Alert WordPress plugin before version 3.9.8 contains an authentication flaw where the "mobile verified" session flag is not properly bound to the verified phone number. This allows an unauthenticated attacker who verifies an OTP on their own phone to supply a different phone number during login, enabling them to log in as any user, including administrators with a billing phone on file. The vulnerability has a high severity score of 7.5 and impacts confidentiality but not integrity or availability.

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled.

ShopMonitor.io WordPress plugin versions before 1.2.0 contain an improper authentication vulnerability that allows unauthenticated attackers to redirect outgoing emails, including administrator password-reset emails, by exploiting a flawed trusted-source check in the email-rerouting test mode. This can lead to full administrator account takeover.

The miniOrange 2FA WordPress plugin versions before 6.2.6 contains an improper authentication vulnerability. The plugin fails to validate the submitted one-time password (OTP) against the targeted user's stored secret, instead verifying it against an attacker-supplied value. This flaw allows an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrator accounts.

The FlxWoo WordPress plugin versions before 3.1.1 contain an improper authentication vulnerability where the plugin does not verify payment processor confirmation before marking orders as paid. This flaw allows unauthenticated attackers to complete WooCommerce orders without making a payment. The vulnerability is identified as CWE-287 and has a high severity score of 7.5. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-14541 is an authentication bypass vulnerability in Google mcp-toolbox version 1.4.0. The flaw occurs when the Google OAuth provider component is initialized with mcpEnabled set to true but without an explicitly defined audience or clientId. This causes the ValidateMCPAuth pipeline to skip audience validation for opaque tokens, allowing acceptance of any valid Google OAuth access token, even those intended for unrelated applications. This can grant unauthorized access to protected tools and data backends.

SolarWinds Web Help Desk contains a critical vulnerability (CVE-2026-28323) involving improper authentication due to a SAML 2.0 authentication bypass. This flaw allows an attacker to bypass authentication mechanisms when SAML 2.0 is enabled, potentially leading to full system compromise.

CVE-2026-56850 is a medium severity vulnerability in Node.js versions 26.x, 24.x, and 22.x. It involves improper authentication due to a flaw in the HTTPS Agent connection reuse mechanism. This flaw can cause PFX object-array key collisions, which may lead to mutual TLS client identities being reused across requests that are configured with different client certificates.

WP Delicious WordPress plugin versions before 1.10.2 contain an improper authentication vulnerability. This flaw allows unauthenticated users to modify certain post metadata via an AJAX action without authorization checks. Specifically, attackers can inflate a like counter and add to an associated identifier list on arbitrary posts.

The Customer Switching WordPress plugin before version 2.1.3 contains an improper authentication vulnerability that allows a lower-privileged user, currently switched into by an operator, to be resolved as that operator and switch into any permitted account, including administrator accounts. This flaw can lead to full account takeover.

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

UsersWP WordPress plugin versions prior to 1.2.67 contain an improper authentication vulnerability that allows bypassing the second factor in two-factor authentication. An attacker who already knows a user's credentials can exploit this flaw to log in without completing the second authentication step.

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup() stores bearer tokens only under the default suffix paths and never adds the custom path to the token map, so self._tokens.get(path) returns None and the authentication guard is skipped. An unauthenticated remote attacker can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers. This issue is fixed in version 2.2.1.