CWE-288 vulnerabilities

A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow an attacker to read or modify system files.

In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing. This vulnerability may result in the exposure of user data across tenants, enabling SaaS applications in different tenants to access and modify information without explicit user authorization. This can lead to unauthorized data access and privacy violations. This vulnerability has no impact if the deployment does not support multi-tenancy.

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

AS228T with Authentication Bypass Vulnerability

In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788.

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842.

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace}, /api/v1/{tenant}/executions/{namespace}/{id}, /api/v1/{tenant}/namespaces/{namespace}/kv/{key}). An anonymous caller picks the literal configs as the final segment, and the request bypasses Basic-Auth entirely. Because the bypass reaches the flow-create and execution-trigger routes, an unauthenticated caller creates a flow containing a Shell or Process task and runs it. The task executes as root inside the kestra container. The official docker-compose.yml mounts /var/run/docker.sock, so root in the container reaches the host Docker daemon. This vulnerability is fixed in 1.0.45 and 1.3.21.

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13.

Steeltoe.Management.Endpoint versions 3.2.2, 3.3.0, and 4.1.0 contain an authentication bypass vulnerability when configured to listen on an alternate port. The middleware incorrectly uses the HTTP Host header instead of the actual network socket port to restrict access, allowing potential unauthorized access to management endpoints. Versions 3.4.0 and 4.2.0 address this issue. Mitigations include upgrading to patched versions or applying explicit ASP.NET Core authorization and configuring reverse proxies to validate the Host header.

CVE-2026-54817 is an authentication bypass vulnerability in the FluxBuilder MStore API affecting versions up to and including 4.18.4. It allows attackers to exploit password recovery functionality via an alternate path or channel, potentially leading to unauthorized actions. The vulnerability is rated medium severity with a CVSS score of 6.5. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-54804 is a high-severity authentication bypass vulnerability affecting Melhor Envio versions up to and including 2.16.3. It involves broken authentication that allows an attacker to bypass normal authentication mechanisms using an alternate path or channel. The vulnerability impacts confidentiality, integrity, and availability to varying degrees. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

CVE-2026-49071 is an authentication bypass vulnerability in OPMC WooCommerce Dropshipping versions up to and including 5.2.4. It allows unauthenticated attackers to bypass authentication mechanisms due to broken authentication controls. The vulnerability is classified under CWE-288 and has a medium severity with a CVSS score of 6.5.

CVE-2026-42629 is a high-severity authentication bypass vulnerability affecting PowerPack Pro for Elementor versions prior to 2.13.0. It allows unauthenticated attackers to bypass authentication mechanisms due to broken authentication via an alternate path or channel. This vulnerability impacts confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently confirmed from the vendor.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.3.

syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid credentials for a user account can bypass the two-factor authentication flow by sending HTTP requests with a crafted User-Agent header containing specific strings such as AtlassianMobileApp or JIRA. When such a User-Agent is present, the plugin does not enforce the configured 2FA checks for protected web resources. Successful exploitation allows the attacker to access the affected Atlassian application as the compromised user without completing 2FA. If the compromised account has administrative privileges, the attacker can access administrative functionality and may disable the 2FA plugin or make arbitrary administrative changes. The issue is fixed in version 3.5.0.0.

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.