CWE-288 vulnerabilities

An authentication bypass vulnerability exists in Omegathemes Grocery Shopping Store up to version 1.3.3. This flaw allows an attacker with limited privileges to exploit the password recovery mechanism via an alternate path or channel, potentially leading to unauthorized actions. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity. No official patch or remediation details are provided in the available data.

CVE-2026-33272 affects Red Lion Controls 700 Series switches. A malicious user with physical access can boot the device from factory settings without authentication, use default administrative credentials to gain administrative access, and save persistent configuration changes. This vulnerability allows unauthorized configuration changes but does not impact availability.

CVE-2026-107361 is an authentication bypass vulnerability in the Arkime live capture service (arkime-live) component of CISA Malcolm. The service runs in host network mode exposing port 8005 on all interfaces and trusts the X-Forwarded-User header from any IP address, automatically creating users with full access. The passwordSecret is hardcoded to a public value "Malcolm", allowing a network-adjacent attacker to bypass nginx and authenticate by connecting directly to port 8005 with a forged identity header. This vulnerability affects Malcolm versions up to and including 26.07.1.

An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.

CVE-2026-107194 is a critical authentication bypass vulnerability in Sungrow iSolarCloud versions prior to 2026-08-25. The flaw allows attackers to bypass authentication and potentially take over accounts by using a specific login parameter "login_type":"5". Exploitation could lead to severe consequences, including local blackouts across Europe. The vulnerability involves improper authentication handling and exposure of user email addresses within parent organizations.

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

CVE-2026-39769 is a high-severity authentication bypass vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor plugin. It allows attackers to exploit the password recovery mechanism via an alternate path or channel, bypassing authentication controls. The vulnerability affects versions from the initial release up to 3.1.12 inclusive.

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0.

In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization() trust the public certificate supplied in the X-Client-Cert request header without proving possession of the corresponding private key. Common Cloud Foundry routers do not remove this header from inbound requests. When inbound requests are not restricted to a known trusted proxy source IP, an attacker who obtains the public certificate of an application instance in the target organization or space and can reach the application can spoof X-Client-Cert to bypass the SameOrg and SameSpace policies for the certificate validity period. This issue is fixed in version 4.3.0.

Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature. As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators