A vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 allows remote attackers to bypass authentication by spoofing due to a flaw in the opendmarc_policy_query_dmarc function within the Multi-Record Set Handler component. The vulnerability has a CVSS score of 7.3 (medium severity). Exploit code is publicly available, but no vendor response or patch has been provided.
The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains.
This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
Python Social Auth's social-core component prior to version 5.0.0 contains an improper authentication vulnerability in the vk-app backend. The backend accepted VK application callback data without verifying the callback signature if the auth_key parameter was missing. This allowed attackers to impersonate arbitrary VK user identities by manipulating callback fields. The issue is fixed in version 5.0.0 by enforcing the presence and validity of auth_key before trusting callback data.
CVE-2026-57175 is an improper authentication vulnerability in python-social-auth's social-core SAML backend prior to version 5.0.0. The flaw allows acceptance of SAML responses without verifying they match a previously issued AuthnRequest. This can enable an attacker with a valid identity on a trusted Identity Provider (IdP) to link their SAML identity to a victim's local account and gain unauthorized access. The issue affects applications using the SAML backend with authenticated account association and was fixed in version 5.0.0 by validating SAML responses against stored AuthnRequest IDs.
CVE-2026-94606 is an improper authentication vulnerability in the open-source identity provider authentik affecting its email authenticator enrollment process. Before fixed versions 2026.2.7, 2026.5.7, and 2026.8.2, the system accepts a recipient email address supplied during setup rather than the one established by the authentication flow. An attacker who knows a target user's password can substitute their own email address to receive the one-time code and complete enrollment as the target user, gaining a session and access to single sign-on applications. This affects only users who have not already enrolled the email factor. Other authenticator types are not impacted.
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
The Norwegian Cruise Line door access control system uses only the static 7-byte UID from an NTAG212 NFC chip to grant entry. This UID is a manufacturer serial number transmitted in clear text and is not designed to authenticate the holder. The system's reliance on this UID alone constitutes identification rather than proper authentication, lacking challenge-response mechanisms to prevent cloning or unauthorized access.
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
CVE-2026-78308 is an improper authentication vulnerability in Deltaww's DIAEnergie product that allows an attacker to bypass authentication. This critical severity flaw affects versions before 1.11.00.022. The vulnerability has a CVSS score of 9.8, indicating it is remotely exploitable without privileges or user interaction, and can lead to full confidentiality, integrity, and availability compromise.
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
CVE-2026-95676 is a high-severity vulnerability in WatchGuard AuthPoint Authentication Gateway versions 4.2.2 up to but not including 7.5.1. It involves a missing or improper authentication check in the LDAP Sync first-factor authentication process, allowing a remote attacker to bypass single-factor password verification under non-default operating conditions. However, additional authentication factors remain enforced, limiting the overall impact.
CVE-2026-75973 is an improper authentication vulnerability in Apache Tomcat affecting multiple versions. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use it, the authentication realm from the first web application is incorrectly applied to all others. This can lead to authentication bypass or cross-application authentication issues. The vulnerability affects Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Fixed versions are 8.5.101, 9.0.122, 10.1.60, and 11.0.26. The CVSS score is 7.3 (high severity).
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication.
The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler therefore has no idea which device sent a given write, and it cannot tell the authenticated one from any other.
Once any device completes the PIN exchange, the flag is set and every nearby device can send CMD_ commands until it resets. An attacker simply waits within radio range for a legitimate user to authenticate, then writes commands into the same window. No PIN is ever guessed or brute-forced.
This is the second step of a three-step chain that JFrog documented against the robot. The first is the unrestricted file upload in the media sounds API, tracked as CVE-2026-55419, which places an attacker-controlled script on the filesystem. This issue then provides command access over Bluetooth. The third is the Bluetooth command handler path traversal, tracked as CVE-2026-62661, which runs that script as root.
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.
The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information.
This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.