Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.
Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Unauthorized access.
DroneAware's centralized server was vulnerable to an account pre-hijacking flaw allowing attackers to register accounts with victim emails and attacker-chosen passwords before the victim activated their account. When the victim later activated the account, the attacker-set password remained valid, enabling silent account takeover without notification. The issue was fixed server-side on 2025-05-20, requiring no user action. Node binaries and self-hosted detection nodes are unaffected. No client-side mitigations or workarounds are needed.
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Three request parameters reach the sink: unit, contactEmail, and documentListURL. The servlet does not verify a real LDAP identity. Allowing the vulnerable insert to proceed. Since the PostgreSQL backend permits stacked queries via Statement.executeUpdate(), this vulnerability allows full read/write/execute access in the Metacat database context. The vulnerability was remediated in Metacat 3.0.0.
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module.
CVE-2026-50623 is an authentication bypass vulnerability in Apache CXF's OAuth2 TokenIntrospectionService. The flaw is due to a missing 'throw' keyword in the security context check, allowing unauthenticated access to the introspection endpoint if authentication is not enabled. The issue is fixed in Apache CXF versions 4.2.2, 4.1.7, and 3.6.12. The vulnerability has a medium severity with a CVSS score of 4.8.
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions:
Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST messages without separating that state when the request principal changes. RFC 4252 allows the user name and service name fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as remaining methods, partial-success state, and in-progress method state, can remain associated with the connection and then influence a later request for a different (user, service). This is an internal library state mismatch. This issue has been patched in version 0.61.0.
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
Affected versions:
Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's check_auth userauth branch wrote request-supplied userVariables into the connection state before comparing the supplied password. The writes are append-only and the connection is not closed on a failed compare, so values declared on bad-password attempts persisted on the same WebSocket and carried into a subsequent successful login on that connection. This issue has been patched in version 1.11.1.
FreeSWITCH versions prior to 1.11.1 contain an improper authentication vulnerability in the mod_verto JSON-RPC handler. The handler binds connections to client-supplied session IDs before authentication, allowing an unauthenticated attacker who knows a target session UUID to evict legitimate clients by causing session collisions. This results in denial of service for the legitimate client. The issue has been fixed in version 1.11.1.
CVE-2026-41720 is a high-severity vulnerability in Spring LDAP where certain DirContextAuthenticationStrategy implementations improperly accept bind requests with a non-empty username and an empty or null password. This affects multiple versions of Spring LDAP, specifically 2.4.0 through 2.4.4, 3.2.0 through 3.2.17, 3.3.0 through 3.3.7, and 4.0.0 through 4.0.3. The vulnerability relates to improper authentication (CWE-287) and could allow unauthorized access if exploited.
CVE-2026-50751 is a critical vulnerability in Check Point Quantum Security Gateway involving improper authentication due to a logic flow weakness in Remote Access and Mobile Access certificate validation within the deprecated IKEv1 key exchange. This flaw allows an unauthenticated remote attacker to bypass user authentication and establish a remote VPN connection without a valid password. The vulnerability has a high CVSS score of 9.3 and is known to be exploited in the wild, including use in ransomware campaigns.
On Tapo
C520WS v2, restricted accounts (for example, hub users) are intended to execute
only a limited set of low‑sensitivity operations. Due to a logic flaw in the
device’s API authorization mechanism, an attacker can craft requests that
leverage legitimate “method mapping” behavior to bypass whitelist restrictions,
allowing restricted operations to be masked as permitted requests and executed.
Successful
exploitation may allow an attacker (with access to a restricted account) to
execute unauthorized sensitive operations.
Depending on the operation invoked, impact could include device
resets, unintended configuration changes, or disruption of normal operation,
leading to loss of availability and integrity of the device.
UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.
An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.
Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Redline WR3200: from 7.1.3 before 7.1.8.
CVE-2026-49202 is a high-severity vulnerability in the Acer Connect M6E 5G Portable WiFi Router. It allows access to internal multimedia session archives without requiring authentication. The issue is worsened by overly permissive Cross-Origin Resource Sharing (CORS) rules, which enable cross-site theft of these resources. No official patch or remediation guidance has been provided by the vendor as of the publication date.
Acer Connect M6E 5G Portable WiFi Router contains an improper authentication vulnerability in its management API for cellular eSIM allocation. The API endpoints do not validate caller authorization, enabling remote attackers to rewrite or delete eSIM profiles without proper permissions. This vulnerability has a high severity score of 7.2 and affects the device's cellular management functionality.