CWE-290 vulnerabilities

CVE-2026-19538 is an authentication bypass vulnerability in NLnet Labs NSD version 4.8.0. The issue allows attackers to bypass BLOCKED access control list items on the proxy protocol port by connecting over TCP or TLS and sending the query twice on a kept-open connection. This flaw can lead to unauthorized access despite intended access restrictions.

CVE-2026-75037 is an authentication bypass vulnerability in the LACT software by ilya-zlobintsev. It arises from Polkit authentication based on UnixProcessSubject / Peer PID, allowing unauthorized access. The issue affects LACT versions up to and including 0.10.0 and has been fixed in a later commit. The vulnerability has a high severity score of 7.0 and impacts confidentiality, integrity, and availability.

CakePHP Authentication versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 contain a vulnerability that allows authentication bypass and potential CPU or memory exhaustion when using the CookieAuthenticator with unencrypted, forgeable legacy tokens. This issue is resolved in versions 2.11.2, 3.3.7, and 4.2.1.

A vulnerability in the authlib joserfc Python library prior to version 1.7.3 allows issuer-validation bypass due to improper handling of array-valued 'iss' claims in JWT token validation. This can lead to authentication bypass by spoofing the issuer claim. The issue is fixed in version 1.7.3.

CVE-2026-71485 is an authentication bypass vulnerability in centrifugal centrifugo before version 6.9.0. It arises because client-supplied headers in the connect request are forwarded to backend services without proper validation, allowing attackers to spoof trusted headers used for authentication and authorization. This can lead to full impersonation of any identity the backend trusts based on these headers. The issue affects all proxy call types and persists for the lifetime of the connection.

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

A critical authentication bypass vulnerability exists in rsync daemon versions up to 3.4.4. This flaw allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address. Exploiting this vulnerability enables attackers who can connect to the rsync daemon to circumvent host allow/deny rules and gain unauthorized access that would normally be blocked based on their real source IP.

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane presenting a tags-bound token can register with kuma.io/workload set to any value and obtain another workload's SPIFFE identity.

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account.