A vulnerability in Sentry versions 26.5.0 through 26.7.1 allows an attacker controlling a SAML identity provider to link their identity to a victim's Sentry account via a socially engineered malicious URL. This improper authentication issue requires a browser that accepts cross-site cookie contexts, such as Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. The vulnerability is fixed in version 26.7.2 and was remediated in the Sentry SaaS environment on July 27, 2026.
CVE-2026-109506 is an improper authentication vulnerability in TP-Link Systems Inc. RE190 v5 Wi-Fi range extenders. The devices use a custom reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture legitimate administrator login traffic may derive alternative credentials to gain administrator access. Exploitation requires the login to use HTTP and the attacker to observe session key, dictionary, and login values. Successful exploitation allows modification of device configuration settings.
CVE-2026-101954 is a critical improper authentication vulnerability in the J-Web management interface and NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network attacker to gain root-level device configuration access and take over the device via reachable J-Web HTTP or HTTPS services when web management is enabled.
CVE-2026-101986 is a critical improper authentication vulnerability in the J-Web interface of Juniper Networks Junos OS and Junos OS Evolved. It allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request. The vulnerability affects multiple versions across Junos OS and Junos OS Evolved releases prior to specific fixed versions. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.
CVE-2026-101956 is a critical improper authentication vulnerability in the J-Web web management component of Juniper Networks Junos OS. It allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web interface. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges or user interaction required, and full confidentiality, integrity, and availability impact.
The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.2 contains an authentication bypass vulnerability. This flaw arises when the 'Use WordPress users as customers' option is enabled, allowing attackers with Subscriber-level access to impersonate other customers by exploiting a fallback check that matches usernames to emails incorrectly. Attackers can access victim customer data and overwrite their email on next login.
CVE-2026-87974 is a medium severity vulnerability in the Asaas Gateway for WooCommerce WordPress plugin before version 2.7.8. The plugin does not properly authenticate its payment webhook, accepting an empty access token by default and failing to verify that the confirmed payment matches the order marked as paid. This allows unauthenticated attackers to mark arbitrary orders as paid.
CVE-2026-53709 is a critical improper authentication vulnerability in IBM mcp-context-forge prior to version 1.0.2. The product shipped with a known JWT secret key, allowing remote unauthenticated attackers to forge administrator tokens. This flaw enables attackers to maintain administrative access despite password changes, account deletions, or session revocations, leading to potential disclosure, modification, and disruption of the service. The issue is fixed in version 1.0.2.
IBM WebSphere Application Server versions 8.5 and 9.0 contain an authentication bypass vulnerability in the CSIv2 inbound propagation handler. This flaw allows a remote attacker to bypass authentication mechanisms, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is identified as CWE-287 (Improper Authentication) and has a high severity with a CVSS score of 8.1.
CVE-2026-95680 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0. It involves improper authentication (CWE-287) that could allow an authenticated attacker to bypass authorization controls, potentially leading to administrative impersonation across the server cell. This could result in full compromise of administrative functions. The vulnerability has a CVSS 3.1 score of 8.0, indicating a significant risk. No vendor patch or remediation details are provided in the available data.
CVE-2026-84312 is an improper authentication vulnerability in the Casdoor SSO flow of 0xJacky nginx-ui. The OAuth state parameter is hard-coded and not validated against a per-session value, enabling login CSRF attacks. An attacker can force a victim's browser to authenticate as the attacker, potentially leading to unauthorized access and data exfiltration. The vulnerability affects versions prior to 2.4.1. A patch is available that implements proper state parameter generation and validation similar to the OIDC flow.
0xJacky nginx-ui versions prior to 2.4.1 contain an improper authentication vulnerability (CWE-287) in the two-factor authentication enrollment endpoints. The endpoints for enrolling TOTP and WebAuthn passkeys require only a valid JWT and are not protected by a secure session middleware, allowing an attacker with a stolen JWT to bind their own second factor to a victim's account without re-authentication. This enables persistent account takeover that survives password resets and locks out legitimate users.
Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain an improper authentication vulnerability in SAML processing. This flaw allows an unauthenticated remote attacker to cause the server to accept a SAML assertion that should be rejected, potentially leading to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.5 and impacts the integrity of the system without affecting confidentiality or availability.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authentication validation weakness. This flaw could allow an attacker to use an invalid token to gain unauthorized access to the server. The vulnerability is classified as CWE-287 (Improper Authentication) and has a high severity rating with a CVSS score of 7.5. There are no known exploits in the wild at this time.
CVE-2026-21134 is an improper authentication vulnerability in Samsung Flow prior to version 4.9.22.4. This flaw allows adjacent attackers to access sensitive information without proper authentication. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.1.
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 44.1. This flaw arises from improper nonce validation in the deprecated OpenID Connect token processing path when the 'use_id_token_parser_v2' option is enabled. An attacker with a previously issued valid id_token can replay it to authenticate as any WordPress user, including administrators, potentially leading to full site takeover.
The WPCOM Member WordPress plugin contains an authentication bypass vulnerability in all versions up to and including 1.7.27. This flaw allows unauthenticated attackers to log in as any WordPress user, including administrators, by exploiting the social-login callback handler. The vulnerability arises from missing nonce validation, OAuth state verification, and session namespace isolation, enabling attackers to forge session entries and impersonate users if they know or can enumerate the victim's social provider identifier. Exploitation requires the target site to have at least one social provider configured.