TP-Link Tapo C210 version 3.6 contains an authentication bypass vulnerability in its DS JSON API. This flaw allows an unauthenticated attacker on the adjacent network to perform protected camera operations, such as pan-tilt-zoom control, without a valid authenticated session. The issue arises from inconsistent application of module-level authorization checks when a crafted JSON request includes both protected and public onboarding-related fields. A fix is available in version V3.6_1.2.7 Build 260818.
CVE-2026-107186 is an improper authentication vulnerability in Eptura Archibus that allows unauthenticated users to execute workflow rules by sending specific DWR requests. This flaw enables running workflow rules without any authentication, potentially leading to unauthorized actions within the application.
Improper Authentication vulnerability in Apache Camel Keycloak component.
This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.
The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim. When the claim was absent the check was skipped rather than treated as a failure, so a token that the configured issuer did not mint could be accepted provided the introspection endpoint answered without naming an issuer. Reaching this requires an introspection endpoint that omits iss and accepts tokens from more than one issuer, which is not the default Keycloak arrangement, hence the low severity; where that arrangement exists the consequence is that the deployment authenticates a caller it should have rejected.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. An absent iss claim is now treated as a validation failure rather than as a reason to skip the check. For deployments that cannot upgrade immediately, ensure the introspection endpoint returns the iss claim, and that it serves exactly one issuer.
CVE-2026-84181 is an improper authentication vulnerability in the Apache Camel Shiro component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The flaw allows credential verification to be skipped if a subject bound to the current thread has the same principal as the incoming exchange, due to thread reuse in the Camel exchange pool. This can enable an attacker to bypass password verification by sending a request with a principal already in use. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1 and later.
Improper Authentication vulnerability in Apache Camel OAuth component.
This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.
The camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an authenticated session should have terminated routing and returned an error to the caller, the processors fell through and returned control to the route, so the request continued to the protected endpoint as though authentication had succeeded. The effect is a fail-open authentication guard: an unauthenticated caller reached whatever the route did next. The condition is reached on the ordinary request path of a route configured to require OAuth, and needs no special configuration or prior access on the caller's part.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The processors now stop the exchange and set the appropriate error status whenever an authenticated session cannot be established, so a failed authentication no longer reaches the protected part of the route. For deployments that cannot upgrade immediately, place an explicit authorization check after the OAuth processor rather than relying on it to halt the exchange, and verify that the route stops on failure.
CVE-2026-104627 is an improper authentication vulnerability in Gitea's OpenID association callback within security settings. The flaw allows an attacker-controlled OpenID provider to link the attacker's identity to a victim's account without the victim's initiation, enabling the attacker to sign in as the victim bypassing local two-factor authentication methods like TOTP or WebAuthn. The issue arises because OpenID 2.0 permits unsolicited assertions, and the callback did not verify that the signed-in user initiated the linking. The vulnerability affects Gitea versions up to 28.1.0. A fix has been implemented requiring a time-limited, user-bound 'state' value in the callback to prevent this attack.
The Appointment Booking Plugin – LatePoint for WordPress contains an authentication bypass vulnerability due to a race condition in the OTP verification process. Versions up to and including 5.7.4 are affected. The flaw arises from a non-atomic increment of the OTP attempts counter, allowing attackers to bypass the 10-attempt lockout by sending concurrent requests. This enables brute-forcing of the 6-digit OTP code and unauthorized access to customer accounts and data. The nonce mechanism does not prevent exploitation as it is publicly accessible. The vulnerability has a critical severity with a CVSS score of 9.1.
Apache Kylin versions 4.0.0 through 5.0.4 contain an improper authentication vulnerability (CWE-287) that allows unauthenticated users to access system cleanup actions. This issue primarily impacts Kylin services exposed directly to public networks, which is uncommon. The vulnerability is fixed in version 5.0.5.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain an improper authentication vulnerability that could allow a remote authenticated attacker to bypass security restrictions. The vulnerability is identified as CWE-287 and has a medium severity with a CVSS score of 4.3. No specific exploit details or active exploitation in the wild have been reported. No patch or remediation information is provided in the available data.
The Vulnity Security plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.4.3. This flaw arises from improper protection of a delegated-login credential file on Nginx-based setups, where the plugin's server configuration snippet incorrectly guards the wrong directory path. Exploiting this allows unauthenticated attackers to access stored credentials, forge signed REST API requests, and gain administrator access.
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.
The Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when a staff or administrator token was issued can compute a valid token and access the booking API as that user, including an administrator.
The miniOrange OTP Login, Verification and SMS Notifications WordPress plugin up to version 5.5.8 contains an authentication bypass vulnerability. This flaw allows unauthenticated attackers to log in as any user, including administrators, by exploiting the Delay OTP grace period mechanism without supplying correct credentials. Exploitation requires specific plugin settings to be enabled, including OTP-only login and Delay OTP Verification, and the target user must be within the Delay OTP interval.
CVE-2026-105034 is a high-severity vulnerability in the EnergizeLab NestJS auth service version 1.8.2. The service issues device tokens for arbitrary robot serial numbers without requiring authentication, allowing unauthenticated remote attackers to obtain valid device tokens and impersonate devices against cloud services.
CVE-2026-57183 is an improper authentication vulnerability in Erudika scoold prior to version 1.69.1. The flaw allows an attacker who obtains either of two signing secrets to forge JWT tokens that grant administrative access to sensitive configuration and server logs via special API endpoints. This bypass occurs even when the API is disabled and does not require a registered API key. The issue is fixed in version 1.69.1.
CVE-2026-102631 is an improper authentication vulnerability in Canonical's authd before version 0.7.1. The flaw occurs because authd resolves user identity by broker-scoped provider ID but falls back to username matching without rejecting conflicting non-empty provider IDs. This can cause a new user to inherit the previous user's local UID and home directory if an identity provider reassigns an email address. Consequently, the new user can access and modify files, including sensitive credentials like SSH keys and cloud API tokens, belonging to the previous user. Administrators are advised to lock or delete the previous user's local authd account when the corresponding identity provider account is removed.
CVE-2026-45451 is an improper authentication vulnerability affecting Unitronics UniStream Pro (B10/C10) and UniLogic versions prior to 1.41.329. This flaw allows an attacker with limited privileges to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity rating with a CVSS score of 8.3. No official patch or remediation details are provided in the available data.
FileRise versions prior to 3.23.0 contain an improper authentication vulnerability where the software maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims without requiring email verification. This allows an attacker who can obtain provider-issued claims that collide with an existing local username to log in as that user, including the administrator, even if automatic provisioning is disabled. The vulnerability is fixed in version 3.23.0.
FileRise versions prior to 3.23.0 have an improper authentication vulnerability involving TOTP replay. The system validates a TOTP code within the accepted time window but does not prevent reuse of the same code for the same account during that window. An attacker with valid primary credentials and a captured TOTP code can replay the code in another login session before it expires. This vulnerability allows bypassing the intended one-time use of TOTP codes but does not disclose credentials or TOTP secrets. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.21.0 have an improper authentication vulnerability where disabled login methods can still be used to authenticate via backend endpoints if valid credentials are known. This bypasses administrator login-method policies but does not allow credential-free access. The issue is fixed in version 3.21.0.