CVE-2026-17370 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain an access token for another user by exploiting insufficient verification in the sign-in flow, potentially enabling identity assumption.
CVE-2026-17358 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass tenant isolation by exploiting insufficiently isolated authentication checks, potentially enabling cross-tenant access.
CVE-2026-17326 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions, potentially leading to unauthorized access with high confidentiality and integrity impact but no availability impact.
CVE-2026-17240 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. Due to inconsistent application of authentication checks, a remote attacker could bypass security restrictions and access protected resources without valid credentials. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-17158 is a critical improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to gain elevated privileges, potentially compromising confidentiality, integrity, and availability of the affected system.
CVE-2026-16720 is a critical improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to obtain valid access tokens for other users by exploiting insufficient enforcement of authentication against a connected directory service. This could enable the attacker to assume another user's identity with full access rights.
CVE-2026-59104 is an authentication bypass vulnerability in SPH Engineering's UgCS server versions before 6.2. The flaw exists in the HCI protocol login handler on TCP port 3334, where if the user database contains exactly one user, a login request with empty credentials is accepted as that single user. The service listens on all interfaces without TLS by default, allowing unauthenticated remote attackers with network access to port 3334 to obtain an authenticated session and issue privileged commands such as controlling drones and uploading flight routes.
CVE-2026-63439 is a critical improper authentication vulnerability in Bubka 2FAuth versions prior to 8.0.0. When the AUTHENTICATION_GUARD is set to reverse-proxy-guard, the application trusts the REMOTE_USER identity header or a custom header without verifying the request's origin from a trusted proxy. This allows remote attackers who can access the application directly to forge identity headers and authenticate as any user, including administrators, potentially exposing stored 2FA secrets and management functions. The issue is fixed in version 8.0.0.
CVE-2026-63438 is a critical improper authentication vulnerability in Bubka's 2FAuth web application prior to version 8.0.0. When configured with AUTHENTICATION_GUARD=reverse-proxy-guard, the application incorrectly accepts authentication headers from clients not passing through a trusted proxy. This flaw allows unauthenticated remote clients to create administrator accounts on fresh instances or impersonate existing users by synchronizing email headers, exposing two-factor authentication secrets and administrative functions. The issue is resolved in version 8.0.0.
FreeScout versions prior to 1.8.225 have an improper authentication vulnerability in the administrative tools.php maintenance endpoint. This endpoint is accessible without proper authentication or access control, allowing attackers to probe for arbitrary directories and files on the server. Additionally, the endpoint permits unrestricted guessing of application keys and database passwords without rate limiting or CAPTCHA protections. This vulnerability is fixed in version 1.8.225.
The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.
OAuthLib versions from 3.3.0 up to but not including 4.0.1 contain an improper authentication vulnerability in the RFC 8628 device workflow. The DeviceCodeGrant.validate_token_request method does not verify the presence or validity of the device_code parameter. This allows an attacker who knows a valid client ID enabled for the device workflow to submit a missing or invalid device code and obtain a bearer token without completing device authorization. The issue is resolved in version 4.0.1.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with network access to the AuthPoint Gateway host to disrupt authentication services and delete the local directory synchronization configuration.
The Easy Digital Downloads WordPress plugin contains an authentication bypass vulnerability in all versions up to 3.7.2. This flaw allows an attacker to impersonate an administrator by initiating a PayPal guest checkout using the administrator's email address. The plugin trusts the email entered during guest checkout as proof of identity, leading to an authenticated session being issued for that administrator account. This results in a full administrator account takeover.
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from being logged in through it. An unauthenticated attacker can trigger a code for any user (including an administrator) via the companion unauthenticated endpoint and brute-force the 6-digit code to obtain an authenticated session as that user, resulting in a full administrator account takeover.
The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions.
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a configured OAuth2 provider could submit another user's name, link their external identity to that Gitea account and be signed in as it without its password, including as an administrator. The link persisted for later sign-ins. Automatic linking now only happens when the existing account matches the provider's email or provider-derived user name; otherwise the account password is required.
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.2.2. This is due to the social login REST callback registered at `/wp-json/wslu-social-login/type/{provider}/` with `permission_callback => __return_true` locating an existing WordPress account solely by the email string returned from the OAuth provider and calling `wp_set_auth_cookie()` without a password check, while the only verification guard — `!empty($getProfile->emailVerified)` in `inc/admin-create-user.php` — is a no-op for the bundled Hybridauth Facebook and Twitter adapters, both of which assign the raw email string rather than a boolean verified flag to `emailVerified`. This makes it possible for unauthenticated attackers to obtain a fully authenticated session as any existing WordPress user, including Administrators, whose registered email address can be presented through a configured Facebook or Twitter login on the target site. Exploitation requires only that the attacker control an OAuth account whose provider-returned email matches the target account's registered WordPress email address; no local credentials, nonce, or prior foothold is needed.
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.