CVE-2026-63329 is a medium severity vulnerability in warp-tech warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux. Versions prior to 0.25.6 improperly forward client-supplied x-warpgate-username headers, allowing an authenticated attacker to potentially impersonate another user if the backend trusts the first header value. The vulnerability also involves acceptance of the reserved x-warpgate-authentication-type header without exclusion. This issue is fixed in version 0.25.6.
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
CVE-2026-69843 is a critical authentication bypass vulnerability in Microsoft Fabric that allows an unauthorized attacker to elevate privileges over a network. The flaw is categorized under CWE-290 (Authentication Bypass by Spoofing). A patch is available and has been officially released by Microsoft to address this issue.
CVE-2026-77903 is a critical authentication bypass vulnerability in Microsoft Dataverse that allows an unauthorized attacker to elevate privileges over a network. The flaw involves spoofing to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability. An official fix is available from Microsoft.
CVE-2026-76949 is an authentication bypass vulnerability in the team-alembic ash_authentication library. It allows an attacker who can plant a remember-me cookie in a victim's browser to replace the victim's authenticated session with the attacker's session. This occurs due to inconsistent session key handling in the remember-me sign-in logic, causing the system to honor the attacker's cookie even when the victim has an active authenticated session. The vulnerability affects versions from 4.10.0 up to but not including 4.15.0, and from 5.0.0-rc.0 up to but not including 5.0.0-rc.14.
pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE_USER from request.environ and, when that returned nothing, fell back to reading the same name directly from the inbound HTTP request headers via request.headers.get(). An inbound HTTP header is written by whoever sends the request, so any client able to reach pgAdmin could supply that header itself and be authenticated as any username it named, including an existing Administrator, without presenting a password or any other credential. The environment lookup could also be satisfied by a client-supplied header whenever WEBSERVER_REMOTE_USER was configured to an HTTP_-prefixed or hyphenated name such as HTTP_X_FORWARDED_USER or X-Forwarded-User, since WSGI servers place inbound headers into the environment under exactly those names. Deployments are affected only when 'webserver' is enabled in AUTHENTICATION_SOURCES.
The fix distinguishes a genuine CGI/WSGI variable from a header-derived one and implicitly trusts only the former. A header-asserted identity is now accepted only when the operator explicitly opts in via WEBSERVER_REMOTE_USER_FROM_HEADER, the request arrives from a peer listed in WEBSERVER_TRUSTED_PROXIES, and, when configured, a shared secret supplied in WEBSERVER_SHARED_SECRET_HEADER matches WEBSERVER_SHARED_SECRET under a constant-time comparison. The trusted-peer check deliberately reads the real socket peer address rather than request.remote_addr, because ProxyFix rewrites the latter from the client-controlled X-Forwarded-For header and would otherwise allow an attacker to claim to be the trusted proxy. As defence in depth, login() now refuses any account whose auth_source is not 'webserver', so a misconfigured trust gate cannot be used to assume an internal or LDAP account.
This issue affects pgAdmin 4: from 6.2 before 9.18.
Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection.
The strategy is meant to keep each connection in its own identity namespace by writing every UserIdentity row's strategy field as "<name>/<connection_id>", but that namespacing never takes effect. __connection_id__ is populated only on the ephemeral runtime struct built per request in dynamic_oidc/plug.ex, and DynamicOidc.IdentityChange.change/3 re-fetches the strategy from the compile-time DSL through Info.strategy_for_action, yielding the persisted struct whose __connection_id__ is its defstruct default of nil. OAuth2.identity_strategy_name/1 therefore falls back to the bare strategy name for both the identity write and the reads in oauth2/user_resolver.ex and oauth2/sign_in_preparation.ex. Since the identity resource's unique key is (uid, strategy), one row exists per sub across every connection, and the identity-match branch runs before any email check. Neither strategy handles iss, so nothing else distinguishes the issuers: OpenID Connect Core section 5.7 makes sub unique only within an issuer, so two connections numbering subjects independently share one subject space.
This issue affects ash_authentication: from 5.0.0-rc.10 before 5.0.0-rc.14.
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, and the gossipsub Peer Exchange path can provide the attacker's own peer ID as expectedPeer. An attacker can therefore sign a record with the attacker's key, place a victim peer ID and attacker-controlled multiaddrs in the payload, and have certified addresses stored for the victim. The poisoned addresses can cause address-book corruption, dial redirection or failure, routing manipulation, and reachability disruption, although the connection upgrade still verifies remote peer identity and prevents a complete identity takeover. The issue is fixed in version 12.0.24.
WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user. An attacker can bypass authentication by using directory entries such as "." or ".." in the cookie, allowing unauthorized access to the administration panel.This issue has been fixed in firmware version 1.1.0.651412
CVE-2026-89327 is an authentication bypass vulnerability in the FluentBoards WordPress plugin versions before 2.0.15. It allows any board member to submit comments that appear to be authored by another user, including administrators, due to lack of verification of the comment author identity.
CVE-2026-15640 is a critical authentication bypass vulnerability in Delinea Secret Server (On-Prem) versions 10.5.0 through 12.1.3. Under certain conditions, a valid SAML Identity Provider (IdP) response can be used to impersonate another Secret Server user, potentially allowing unauthorized access. The vulnerability has a high CVSS 4.0 score of 9.5, indicating severe impact. No official patch or remediation information is provided in the available data.
CVE-2026-59157 is an authentication bypass vulnerability in webhookd versions prior to 1.22.0. The issue arises when deployments without htpasswd authentication forward all incoming HTTP headers into hook script environments without an allowlist. Specifically, if an upstream reverse proxy does not strip the client-supplied X-WebAuthn-User header, a remote unauthenticated attacker can spoof this header to impersonate another user. This allows bypassing script security controls and accessing or modifying resources with the impersonated identity's privileges. The vulnerability is fixed in webhookd version 1.22.0.
CVE-2026-49446 is an improper authorization vulnerability in azukaar Cosmos-Server versions prior to 0.22.19. The flaw allows an attacker with a valid API key for an enrolled device to bypass authentication and authorization checks by manipulating forward-auth headers through the Constellation Nebula tunnel. This enables user impersonation and unauthorized admin-level access to proxied applications. The issue is fixed in version 0.22.19.
CVE-2026-73449 is an authentication bypass vulnerability in Arista Networks EOS affecting configurations with both 802.1X port authentication and RADIUS proxy dynamic authorization enabled. A low-privileged attacker on an adjacent network segment can induce RADIUS packets through a configured RADIUS proxy client to block dynamic authorization messages such as Change-of-Authorization and Disconnect-Requests. This prevents the disconnection of endpoint sessions that the RADIUS server or network access control system has ordered to be terminated, allowing unauthorized continued network access. The vulnerability requires explicit configuration of both features to be exploitable. No known malicious exploitation has been reported.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.