CWE-1390 vulnerabilities

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.

Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.

Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.

Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.

Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-92289 is a critical vulnerability in Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl. It allows a PKCE bypass for public Relying Parties in "PKCE or secret" mode due to improper verification of the client secret. An attacker who intercepts an authorization code can exchange it for user tokens by replaying the client_id with any secret, bypassing PKCE protections.

CVE-2026-92288 is a critical vulnerability in Lemonldap::NG::Portal versions >=2.20.0 <2.21.6 and >=2.22.0 <2.23.4. It allows unauthenticated OAuth2 token introspection due to weak authentication checks for public Relying Parties. An attacker with an access token and knowledge of a public client_id can confirm token validity and read sensitive token metadata, including user identifiers, potentially correlating user identities across clients.

CVE-2026-94455 is a vulnerability in GitroomHQ's postiz-app allowing unauthenticated creation of enterprise organizations with elevated privileges. The affected HTTP endpoint lacks proper authentication checks, relying solely on a token signed with the instance secret but not verifying token purpose or expiry. This flaw permits an attacker with a valid user session token to create a new organization with the highest subscription tier and obtain its API key, which is immediately valid for API access.

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.

Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.