CWE-288 vulnerabilities

CVE-2026-17313 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to bypass authentication via an alternate path, potentially obtaining sensitive information and gaining control over gateway configuration.

CVE-2026-84473 is an authentication bypass vulnerability in Kiteworks ownCloud server versions 10.16.3 up to but not including 11.1.0. It allows unauthenticated remote attackers to perform unlimited online password guessing attacks against WebDAV accounts by repeatedly sending HTTP Basic Authentication requests to the WebDAV endpoint. This vulnerability is due to improper restriction of excessive authentication attempts, lacking brute-force protection.

CVE-2026-123746 is an authentication bypass vulnerability in the Symfony Security HTTP component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The flaw occurs because the AuthenticatorManager::authenticateUser() method does not invoke the firewall user checker's checkPostAuth() method when users are authenticated programmatically. This allows accounts rejected by custom user checkers in checkPostAuth(), such as expired accounts, to be authenticated via programmatic flows like password resets or email verification. The default user checker is not affected. The issue is fixed by dispatching the security.authentication.success event to trigger checkPostAuth() during programmatic authentication.

OpenHuman versions before 0.56.0 have an authentication bypass vulnerability in the Socket.IO handlers. While HTTP POST requests to /rpc are protected by bearer token middleware, the Socket.IO rpc:request and chat:start handlers lack equivalent authentication. This allows a local unauthenticated client to connect and invoke sensitive operations such as reading configuration or health data, starting agent flows, interacting with account APIs, modifying local data, or stopping and restarting services. The issue is fixed in version 0.56.0.

Apache OFBiz versions prior to 24.09.08 contain an authentication bypass vulnerability in the RequestHandler component. This flaw allows a remote unauthenticated attacker to access protected views by appending the protected path as a suffix to a public request path, causing improper authorization. The issue is fixed in version 24.09.08.

Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the RequestHandler.renderView function. This flaw allows remote unauthenticated attackers to bypass request-map authentication by manipulating the _LAST_VIEW_NAME_ value stored in the anonymous session. As a result, protected views and associated business data may be exposed without proper authorization. The issue is fixed in version 24.09.08.

GLPI versions from 11.0.0 up to but not including 11.0.8 contain an authentication bypass vulnerability that allows unauthenticated users to skip two-factor authentication by using a crafted URL during login. This flaw is fixed in version 11.0.8.

CVE-2026-104203 is a vulnerability in Traccar, an open source GPS tracking system, affecting versions from 5.1 up to but not including 6.15.0. It allows an unauthenticated attacker to bypass session and device authorization checks by exploiting a path parameter parsing discrepancy between MediaFilter and Jetty ResourceServlet. This enables read-only access to protected device media files such as photographs, audio, or video. The issue is fixed in version 6.15.0.

Silverstripe MFA versions prior to 6.0.0 have an authentication bypass vulnerability in the CMS 5 password reset flow. After a user changes their password, a logged-in session can be issued before completing the multi-factor authentication challenge. This allows an attacker with access to the user's email account to bypass the additional authentication factor. The issue is fixed in version 6.0.0.

ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

CVE-2026-115829 is a critical authentication bypass vulnerability in Delinea Secret Server (On-Prem) versions earlier than 12.3.1. It allows an attacker to generate a two-factor authentication (2FA) PIN code for any account without prior authentication and then bypass the initial login step by authenticating using only the second factor.

CVE-2026-107254 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It affects versions from 0.0.0 up to but not including 1.0.1. The flaw allows attackers to bypass authentication by exploiting an alternate path or channel. The vulnerability has a medium severity with a CVSS score of 4.8. A fixed version, 1.0.1, is available to address this issue.

CVE-2026-107261 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It affects versions from 0.0.0 up to but not including 1.0.1. The flaw allows an attacker to bypass authentication by using an alternate path or channel. The issue has been fixed in version 1.0.1. The CVSS score is 4.2, indicating a medium severity level.

CVE-2026-114539 is an authentication bypass vulnerability in Drupal DocCheck Basic versions 7.x. This flaw allows attackers with limited privileges to bypass authentication mechanisms by using an alternate path or channel. The vulnerability has a medium severity rating with a CVSS score of 6.3.

CVE-2026-114572 is an authentication bypass vulnerability in the Drupal Domain Login Restrict module. It allows attackers to bypass authentication using an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.5.0. A fix is available in version 1.5.0. The vulnerability has a medium severity with a CVSS score of 5.4.

CVE-2026-118582 is an authentication bypass vulnerability in the Drupal CAPTCHA module. It allows attackers to bypass authentication by using an alternate path or channel, affecting CAPTCHA versions from 0.0.0 up to but not including 1.18.0, and from 2.0.0 up to but not including 2.0.11. The vulnerability has a high severity with a CVSS score of 7.3.

CVE-2026-118572 is an authentication bypass vulnerability in the Drupal OAuth Login - OAuth OIDC SSO module. It affects versions from 0.0.0 up to but not including 3.1.1. The flaw allows an attacker to bypass authentication by using an alternate path or channel. The vulnerability has a medium severity with a CVSS score of 4.8. A fix is available in version 3.1.1.

CVE-2026-118554 is an authentication bypass vulnerability in the Drupal OpenID Connect Client module. It allows attackers to bypass authentication by exploiting an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 2.3.1. A fix is available in version 2.3.1. The vulnerability has a medium severity rating with a CVSS score of 5.4.