CWE-287: Improper Authentication vulnerabilities

PraisonAI versions from 4.5.112 up to but not including 4.6.59 contain an authentication bypass vulnerability in the Recipe HTTP server. The server can be started on a non-localhost interface without authentication, allowing unauthenticated access to the recipe API and potentially the /admin/reload endpoint. This issue is fixed in version 4.6.59.

CVE-2026-93489 is an improper authentication vulnerability in ASUS router modules that allows an unauthenticated nearby attacker to send crafted HTTP requests to forge an access ticket. This flaw enables the attacker to perform administrator-level operations on the affected router. The vulnerability has a high severity score of 8.7 and does not require user interaction or privileges to exploit.

CVE-2026-97785 is a critical improper authentication vulnerability in Microsoft Entra application proxy that allows unauthorized attackers to elevate privileges over a network. The flaw is addressed by an official fix from Microsoft.

Authlib versions prior to 1.9.0 have an improper authentication vulnerability in the JWTBearerGrant implementation. The default get_audiences() method returns an empty list, causing the verify_claims() method to only check for the presence of an aud claim without verifying it matches the current authorization server. This allows an attacker with a valid assertion for another service sharing the signing key to obtain an access token improperly. The issue is fixed in version 1.9.0.

Authlib versions prior to 1.9.1 contain an improper authentication vulnerability where zero-length key material is accepted in certain cryptographic operations. This allows a remote attacker to forge valid HS256, HS384, or HS512 signatures for arbitrary token claims if the application's secret lookup returns empty keys. The issue is fixed in version 1.9.1.

CVE-2026-114607 is a critical improper authentication vulnerability in the better-auth TypeScript library versions from 1.4.0-beta.18 up to but not including 1.7.7. The flaw arises when specific configuration settings involving Magic Link tokens and OAuth state identifiers cause these tokens to be treated equivalently. This allows an attacker to bypass authentication by redeeming OAuth sign-in state values as Magic Link tokens without mailbox control or completing OAuth callbacks, potentially gaining unauthorized user sessions or creating accounts marked as email verified. The issue is fixed in version 1.7.7.

The Royal MCP WordPress plugin versions before 1.5.7 contain an improper authentication vulnerability. The plugin does not restrict preview-link tokens to the specific preview they were issued for. As a result, anyone with a valid token can authenticate as the token's owning user, who is an administrator by default, across the entire REST API without requiring a nonce. This flaw allows full site takeover.

NT OneAPP by NewType Infortech contains an authentication bypass vulnerability (CWE-287) that allows unauthenticated local attackers to bypass the app's PIN lock via a Deep Link. This enables access to protected resources of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 6.9, indicating a medium severity risk.

A critical authentication bypass vulnerability (CWE-287) exists in the Laravel framework's TokenGuard API guard prior to versions 12.68.0 and 13.29.0. The flaw allows crafted non-string credentials to bypass authentication under certain MySQL or MariaDB configurations, potentially enabling attackers to take over user accounts on routes protected by TokenGuard. This issue has been fixed in Laravel versions 12.68.0 and 13.29.0.

CVE-2026-86249 is a critical improper authentication vulnerability in Apache bRPC versions prior to 1.18.0. It allows remote attackers to bypass authentication by exploiting the HTTP built-in service exemption on the internal_port. An attacker can send a request such as GET /status to the internal_port to authenticate the entire connection, after which subsequent requests on the same connection bypass credential verification. The issue is fixed in version 1.18.0, which restricts internal_port to only built-in and Tabbed services and rejects ordinary service requests with HTTP 403.

CVE-2026-48830 is a critical improper authentication vulnerability in Apache bRPC through version 1.17.0. It allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by sending a builtin HTTP request first on the same HTTP/1.1 keep-alive connection. This issue occurs when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, causing the connection to be treated as authenticated for subsequent requests on that socket. The vulnerability is fixed in Apache bRPC version 1.18.0.

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that victim's abandoned-cart record, for example unsubscribing them from recovery emails or applying an arbitrary coupon to their restored cart.

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login.

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.

CVE-2026-105949 is an improper authentication vulnerability in Cruise Control for Apache Kafka. The Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard and does not deny uncovered HTTP methods. This allows requests with extra path segments to bypass authentication and access all 15 admin endpoints without authorization. In Red Hat AMQ Streams deployments, network policies restrict access to port 9090 to operator pods, reducing the effective severity. The vulnerability is rated high severity with a CVSS score of 8.8. A fix is available in Cruise Control version 3.1.0.

CVE-2026-113469 is a high-severity vulnerability in Stormshield Network Security affecting versions 4.3.0 through 4.3.44, 4.8.0 through 4.8.19, 5.0.0 through 5.0.9, and 5.1.0 through 5.1.3. It involves a logic error in the dynamic data files signature verification during the Autoupdate routine, allowing unauthenticated dynamic data updates.

CVE-2026-111090 is a high-severity vulnerability in Stormshield Network Security products caused by a logic error in the signature verification routine. This flaw allows acceptance of unauthenticated update and license files. To mitigate risk, users must only retrieve update files or licenses from MyStormshield servers or use automatic verification via SNS.

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

TP-Link Tapo C210 version 3.6 contains an improper authentication vulnerability where shared credential material and cryptographic metadata are exposed via unauthenticated DS JSON API requests. This exposure allows an attacker on an adjacent network to use the shared credential as an administrative password to establish encrypted media sessions without knowing the device account password. Successful exploitation can disclose sensitive credential and cryptographic information and enable unauthorized access to encrypted media streams.