Open edX Platform enables the authoring and delivery of online learning at any scale. From the maple release to before the ulmo release, an unauthenticated attacker can fully bypass the email verification process by combining two issues: the OAuth2 password grant issuing tokens to inactive users (documented behavior) and the activation_key being exposed in the REST API response at /api/user/v1/accounts/. This issue has been patched in the ulmo release.
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks.
Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.
ConvoyPanel versions from 3.9.0-beta up to but not including 4.5.1 contain an authentication vulnerability in the JWTService::decode() method. The method failed to verify the cryptographic signature of JWT tokens, only validating time-based claims. This flaw allows attackers to forge or tamper with JWT tokens, including modifying the user_uuid claim, enabling authentication as any user. The vulnerability affects the single sign-on (SSO) authentication flow and has been patched in version 4.5.1.
Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 under certain load conditions could allow an attacker to bypass authentication mechanisms and gain unauthorized access to the application.
Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.
Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.
CVE-2025-15484 is a critical improper authentication vulnerability in the Order Notification for WooCommerce WordPress plugin before version 3.6.3. The flaw allows unauthenticated requests to bypass WooCommerce's permission checks, granting full read and write access to store resources such as products, coupons, and customer data. This vulnerability has a CVSS score of 9.1, indicating a high impact on confidentiality and integrity without requiring user interaction or privileges. No official patch or remediation information is provided in the available data. There are no known exploits in the wild at this time. Users of affected versions should verify vendor advisories for updates and apply patches once available.
CVE-2026-0558 is a high-severity vulnerability in parisneo/lollms up to version 2.2.0 where the /api/files/extract-text endpoint does not require authentication. This improper authentication allows unauthenticated users to upload and process files, potentially causing denial of service through resource exhaustion, information disclosure, and violation of security policies. There is no confirmed patch available at this time.
Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.
Incus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the authentication token such that an invalid value will be accepted. `incus webui` runs a local web server on a random localhost port. For authentication, it provides the user with a URL containing an authentication token. When accessed with that token, Incus creates a cookie persisting that token without needing to include it in subsequent HTTP requests. While the Incus client correctly validates the value of the cookie, it does not correctly validate the token when passed int the URL.
This allows for an attacker able to locate and talk to the temporary web server on localhost to have as much access to Incus as the user who ran `incus webui`. This can lead to privilege escalation by another local user or an access to the user's Incus instances and possibly system resources by a remote attack able to trick the local user into interacting with the Incus UI web server. Version 6.23.0 patches the issue.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using mTLS for client identity, with `verify_and_map` to derive a NATS identity from the client certificate's Subject DN, certain patterns of RDN would not be correctly enforced, allowing for authentication bypass. This does require a valid certificate from a CA already trusted for client certificates, and `DN` naming patterns which the NATS maintainers consider highly unlikely. So this is an unlikely attack. Nonetheless, administrators who have been very sophisticated in their `DN` construction patterns might conceivably be impacted. Versions 2.11.15 and 2.12.6 contain a fix. As a workaround, developers should review their CA issuing practices.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a `Nats-Request-Info:` message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NATS clients could make their own decisions on how to trust a message, provided that they trust the nats-server as a broker. A leafnode connecting to a nats-server is not fully trusted unless the system account is bridged too. Thus identity claims should not have propagated unchecked. Prior to versions 2.11.15 and 2.12.6, NATS clients relying upon the Nats-Request-Info: header could be spoofed. This does not directly affect the nats-server itself, but the CVSS Confidentiality and Integrity scores are based upon what a hypothetical client might choose to do with this NATS header. Versions 2.11.15 and 2.12.6 contain a fix. No known workarounds are available.
n8n versions prior to 2.4.0 and 1.121.0 contain an improper authentication vulnerability when LDAP authentication is enabled. An authenticated LDAP user who can modify their own LDAP email attribute could impersonate another user, including administrators, by matching their email, resulting in permanent account takeover. This occurs because n8n automatically links LDAP identities to existing local accounts based on email attribute matching, and the linkage persists even if the LDAP email is reverted. The vulnerability requires LDAP authentication to be configured and active. It has been fixed in n8n versions 2.4.
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server provides an MQTT client interface. Prior to versions 2.11.15 and 2.12.5, Sessions and Messages can by hijacked via MQTT Client ID malfeasance. Versions 2.11.15 and 2.12.5 patch the issue. No known workarounds are available.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false. This issue has been patched in versions 8.6.52 and 9.6.0
Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.
The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeover in all versions up to, and including, 28.1.5. This is due to the email confirmation handler in `users-registry-check-after-email-or-pin-confirmation.php` using the user's email string in a `WHERE ID = %s` clause instead of the numeric user ID, combined with an unauthenticated key-based login endpoint in `ajax-functions-frontend.php`. When the non-default `RegMailOptional=1` setting is enabled, an attacker can register with a crafted email starting with the target user ID (e.g., `1poc@example.test`), trigger the confirmation flow to overwrite the admin's `user_activation_key` via MySQL integer coercion, and then use the `post_cg1l_login_user_by_key` AJAX action to authenticate as the admin without any credentials. This makes it possible for unauthenticated attackers to take over any WordPress administrator account and gain full site control.
CVE-2026-32879 is a medium-severity improper authentication vulnerability in QuantumNous new-api versions 0.10.0 through 0.11.9-alpha.1. The flaw allows an authenticated user with a registered passkey to bypass the WebAuthn assertion step in the secure verification flow, effectively weakening the step-up authentication process. This vulnerability does not require user interaction and affects confidentiality but not integrity or availability. No patches are currently available, so organizations should avoid relying on passkey-based step-up verification for privileged actions and instead require TOTP or 2FA or restrict access to sensitive endpoints. The vulnerability impacts organizations using QuantumNous new-api, particularly those leveraging its AI asset management and LLM gateway capabilities.
CVE-2026-33716 is a critical improper authentication vulnerability in WWBN AVideo versions up to 26.0. The flaw exists in the standalone live stream control endpoint, which accepts a user-controlled streamerURL parameter that redirects token verification to an attacker-controlled server. This bypasses authentication entirely, allowing unauthenticated attackers to control live streams, including stopping/starting recordings and dropping active publishers. The vulnerability has a CVSS score of 9.4, indicating high impact and ease of exploitation without any privileges or user interaction. A patch is available in commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128. Organizations using affected versions should urgently apply the patch to prevent unauthorized live stream manipulation and potential service disruption.