CWE-306: Missing Authentication vulnerabilities

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability due to missing authentication on the registration endpoint. This flaw allows a remote attacker to overwrite administrator email information and misuse the server as an outbound relay. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-72529 is a critical vulnerability in TrueConf Server that allows remote attackers with network access to port 4307/TCP to execute arbitrary scripts without authentication. This affects multiple versions of TrueConf Server prior to 5.3, as well as specific ranges within 5.3.x, 5.4.x, and 5.5.x. The flaw stems from missing authentication on a critical function accessible via an undocumented call.

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass

CVE-2026-56677 is a high-severity vulnerability in decolua 9router versions 0.5.4 and earlier. It involves a missing authentication check on the POST /api/auth/oidc/test endpoint, which allows unauthenticated attackers to scan internal services and retrieve OpenID Connect discovery information when dashboard login is disabled.

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.

A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.

PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-30584.

CVE-2026-50027 is a critical authentication bypass vulnerability in doobidoo's mcp-memory-service versions prior to 10.67.1. The vulnerability allows unauthenticated remote attackers to perform unauthorized read, write, and delete operations on the memory store via HTTP routes under /api/documents/*. This occurs despite the server being configured with API key or OAuth authentication, due to inconsistent enforcement compared to the /api/memories endpoint. The issue is fixed in version 10.67.1.

CVE-2026-73666 is a high-severity vulnerability in OpenChoreo backstage-plugins where certain versions prior to 1.0.4, 1.1.4, and 1.2.1 have authentication disabled by default. This misconfiguration exposes API endpoints under /api/* without requiring authentication, allowing unauthenticated users to read catalog data, view scaffolder logs, and create or delete catalog locations. The issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 are affected by an authentication bypass vulnerability when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. This vulnerability allows unauthenticated attackers to access critical functions without proper authentication.

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker service that listens on all network interfaces without authentication. An unauthenticated attacker with network access to the MQTT service on a vulnerable system can read data and control connected lights. Fixed in 1.77.2071318010.

WebErpMesv2 versions 1.19 and prior contain an improper input validation vulnerability that allows any self-registered user to upload arbitrary PHP files via the HR Expense scan_file parameter, resulting in remote code execution. The vulnerability is exacerbated by open registration and broken role middleware that silently swallows exceptions, enabling effectively unauthenticated remote code execution on default installations. A patch addressing this issue is available in commit 5c54862fa044b363fd2be03d586750e81afd6818.

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_tree, tap, swipe, type_text, launch_app, press_key, and click_control against an ADB-connected Android device, disclose screen and device data, and modify device state. This issue is fixed in version 3.0.8.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticated remote attackers can directly access and operate the system.

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.