CWE-287: Improper Authentication vulnerabilities

Waline versions prior to 1.41.1 have an improper authentication vulnerability in the login endpoint. The endpoint fails to validate the email field's type, allowing a non-string value to bypass the email filter in the MongoDB query. This causes the system to authenticate against the first registered user (typically the administrator) if the submitted password matches. This is a partial authentication bypass requiring a valid password for the administrator account. The issue enables user enumeration and amplifies credential-stuffing attacks against the administrator account. The vulnerability is fixed in version 1.41.1.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain an improper authentication vulnerability (CWE-287). This flaw allows a low privileged remote attacker to potentially bypass protection mechanisms. The vulnerability is rated high severity with a CVSS score of 8.3. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and specific LTS releases contain an improper authentication vulnerability (CWE-287). This flaw allows an unauthenticated remote attacker to execute arbitrary commands with root privileges. The vulnerability is critical with a CVSS score of 9.8. Dell has released fixed versions starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 onwards and recommends upgrading promptly.

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.

The Customer Email Verification for WooCommerce WordPress plugin up to version 2.8.2 contains an authentication bypass vulnerability. This flaw arises from a predictable email verification token and lack of proper capability or nonce checks in the authentication function. Attackers can exploit this to log in as a verified customer or mark an existing account as verified without authorization. Exploitation depends on the presence of a specific database schema column from older plugin versions.

The Jupiter X Core WordPress plugin up to version 4.61.0 contains an authentication bypass vulnerability in its Twitter/X social login handler. The flaw arises because the plugin fails to update the OAuth token after exchanging the oauth_verifier, causing the API call to authenticate using the site owner's credentials instead of the visitor's. This allows an attacker to be authenticated as the WordPress user whose email matches the site owner's, typically an administrator.

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.

Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

The Qode Membership WordPress plugin contains an authentication bypass vulnerability in all versions up to 2.0.6.2. A typographical error in the Facebook OAuth token verification code disables proper token validation, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying a known username. The exploit requires obtaining a nonce that is publicly accessible on pages with certain shortcodes, making exploitation feasible without prior authentication.

CVE-2026-65211 is an improper authentication vulnerability in the SMCI MBD-X12SPI product. It allows an authenticated IPMI Administrator to read and write arbitrary BMC physical memory, potentially enabling code execution on the BMC operating system. This vulnerability has a high severity with a CVSS score of 7.2.

The Payment Integration Wompi WordPress plugin versions up to 4.0.1 do not verify the authenticity of incoming payment notifications by default. This is because the callback checksum relies on a merchant secret that is empty until manually configured. As a result, an unauthenticated attacker can forge payment notifications and mark arbitrary orders as paid.

The Payex Payment Gateway for Woocommerce WordPress plugin up to version 1.2.10 has an authentication flaw where it does not properly verify payment notifications. The plugin relies on a validation secret that is empty by default, enabling unauthenticated attackers to forge payment confirmations and mark orders as paid without authorization.

A vulnerability in the Payment Gateway WordPress plugin up to version 2.2.0 allows unauthenticated attackers to forge valid payment notifications if a shared secret is not configured. This can result in marking any WooCommerce order as paid. Additionally, the same callback can move any pending order to a failed state regardless of secret configuration.

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

WP Stripe Checkout versions before 1.2.2.62 do not verify the Stripe webhook signature when no signing secret is configured, which is the default setting. This allows unauthenticated attackers to forge payment completion notifications and create completed orders without payment.

The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.

CVE-2026-55459 is an authentication vulnerability in intranda goobi-viewer-core versions from 25.01 up to but not including 26.05. The flaw arises because the application does not properly enforce the 'aud' (audience) claim during JWT token verification, allowing tokens intended for different relying parties to be accepted incorrectly. This can enable an attacker to authenticate as another user. The issue has been fixed in version 26.05.

CVE-2026-55457 is an improper authentication vulnerability in intranda goobi-viewer-core versions prior to 26.05. The application returns an empty string as a default token when no web API token is configured, and the authorization filter accepts requests with an empty token parameter. This allows unauthorized users to access endpoints that should be protected. The vulnerability has been fixed in version 26.05.

PraisonAI versions 4.6.56 through 4.6.58 contain an improper authentication vulnerability in the LinearBot component. The bot starts a public webhook listener without requiring the LINEAR_WEBHOOK_SECRET, allowing unauthenticated network callers to submit forged Linear-Event: AgentSession requests. This leads to unauthorized processing of these requests and potential misuse of the bot's capabilities. The issue is fixed in version 4.6.59.