CWE-288 vulnerabilities

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials to access MCP tools and resources protected by those policies. This issue is fixed in version 1.7.2.

Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion. This issue affects Zenius EMS 8.0: through OAM (Build 109).

Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.

Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVE-2026-83527 is an authentication bypass vulnerability in Ivanti Sentry versions before R10.8.2, R10.7.3, and R10.6.4. It allows a remote unauthenticated attacker to gain administrative level access by exploiting an alternate path or channel. The vulnerability has a high severity with a CVSS score of 8.1.

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.

CVE-2026-62916 is a critical authentication bypass vulnerability in Microsoft Entra ID that allows an unauthorized attacker to elevate privileges over a network by exploiting an alternate path or channel.

Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

CVE-2026-76943 is a critical authentication weakness in the Xiiaozet LK100W device's administrative service. This vulnerability allows attackers to bypass access controls and gain command execution capabilities. Exploiting this flaw could enable unauthorized access to privileged functions and potentially lead to full device compromise.

CVE-2026-65641 is a critical authentication bypass vulnerability in Veeam One that allows an unauthenticated network attacker to coerce SMB authentication from the service account. This vulnerability is classified under CWE-288, indicating an authentication bypass using an alternate path or channel. The CVSS 4.0 base score is 9.3, reflecting its critical severity. No affected versions or patch information are currently provided, and no known exploits are reported in the wild.

CVE-2026-16639 is a critical authentication bypass vulnerability in the Drupal Internationalization Single Sign-On module. It allows attackers to bypass authentication using an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.8.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. A fixed version 1.8.0 is available to remediate this issue.

CVE-2026-63587 is an authentication bypass vulnerability in the Weidmueller IE-SR-2TX-WL-4G-EU device's SMS control function. The device can be configured to require a password for SMS commands, with a retry counter that disables password authorization after 5 failed attempts. An unauthenticated attacker can exploit this by sending 5 invalid SMS password attempts, causing the device to disable password checks and accept subsequent SMS commands without authentication. This can lead to limited configuration tampering, information leakage, and potentially full loss of availability. The vulnerability affects version 1.67 of the device firmware. No patch or official remediation is currently available. The CVSS 4.0 score is 8.8, indicating high severity.

CVE-2026-78259 is a high-severity authentication bypass vulnerability affecting WP Legal Pages (WPLegalPages) versions up to and including 3.7.0. The flaw involves unauthenticated broken authentication, categorized under CWE-288, which allows attackers to bypass authentication mechanisms using an alternate path or channel. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.