CVE-2026-100351 is an authentication bypass vulnerability in the kin-openapi library's openapi3filter.ValidationHandler.Middleware. It arises when a downstream gorilla/mux router uses UseEncodedPath(), causing a mismatch between the decoded path used for validation and the encoded path used for routing. This allows an unauthenticated request with an encoded path to bypass authentication and reach a protected handler. The issue affects kin-openapi versions from 0.144.0 up to but not including 0.147.0. The vulnerability can lead to unauthorized execution of protected handlers without invoking the authentication callback.
CVE-2026-57176 is an authentication bypass vulnerability in python-social-auth's social-core component affecting the Vend OAuth2 backend prior to version 5.0.0. The issue arises when multiple Vend shops authenticate through the same application, causing user ID collisions due to reliance on numeric Vend user_id as the social-auth UID. This allows a user from one shop to be authenticated as a different local account associated with the same numeric user ID from another shop. The vulnerability is patched in version 5.0.0.
CVE-2026-76183 is a critical authentication bypass vulnerability in Apache Tomcat affecting multiple versions from 7.0.43 through 11.0.25. It allows bypassing security constraints on WebSocket endpoints, potentially enabling unauthorized access. The issue is fixed in Apache Tomcat versions 11.0.26, 10.1.60, and 9.0.122. Users should upgrade to these versions to mitigate the risk.
CVE-2026-73511 is an authentication bypass vulnerability in Envoy proxy caused by inconsistent path matching behavior with backend servers that strip semicolon matrix parameters per path segment. This allows a remote attacker to bypass path-based access controls by crafting requests that cause Envoy to select an unprotected fallback path while the backend resolves the protected resource. The issue affects Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 and is fixed in these versions.
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
The MyHome Core WordPress plugin up to version 4.4.5 contains an authentication bypass vulnerability due to missing authorization checks and improper token validation. This flaw allows unauthenticated attackers to generate activation tokens and obtain valid authentication cookies for unconfirmed user accounts, including administrators. Exploitation requires specific configuration settings in the MyHome theme and that the target account lacks a particular user meta flag.
Winter CMS versions up to 1.2.12 have an authentication bypass vulnerability in the CMS Theme Editor AJAX handlers. These handlers do not enforce per-template-type permission checks, allowing authenticated backend users with any CMS permission to perform unauthorized actions on other template types. Additionally, the AssetList widget allows unauthorized file uploads due to missing theme validation. This issue is fixed in version 1.2.13.
The Classified Listing - Mobile Number Verification plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.6.0. This flaw arises from missing server-side Firebase OTP validation in the process_otp_login() function, allowing unauthenticated attackers to log in as any user by submitting arbitrary OTP codes and user IDs. Exploitation requires OTP login enabled with Firebase as the verification gateway and knowledge or guessing of the target's registered phone number. Administrator accounts with registered phone numbers are also vulnerable to takeover.
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
CVE-2026-10842 is an authentication bypass vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty releases from 17.0.0.3 through 26.0.0.7. This flaw could allow a remote attacker to bypass security constraints without authentication.
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
A vulnerability in Node.js TLS hostname handling involving Unicode dot separator normalization can cause a wildcard-depth authentication bypass. This flaw affects multiple supported Node.js release lines including versions 22, 24, and 26. The issue arises from mismatched hostname normalization between resolver and verifier components, potentially allowing an attacker to bypass intended TLS authentication boundaries. The vulnerability has a CVSS 3.0 score of 7.7, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Red Hat has released security updates addressing this issue in their Node.js packages.
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
Authentication Bypass by Alternate Name vulnerability in Apache Shiro.
This issue affects Apache Shiro: before 2.0.7.
Users are recommended to upgrade to version 2.0.7, which fixes the issue.
The issue only effects static files. If static files are served from a case-insensitive filesystem,
such as default macOS setup, static files may be accessed by varying the case of the filename in the request.
If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.
Shiro 2.1.0 and later has a new parameters to remediate this issue
shiro.ini: filterChainResolver.caseInsensitive = true
application.properties: shiro.caseInsensitive=true
Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations.
Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.
CVE-2026-24058 is a critical authentication bypass vulnerability in charmbracelet soft-serve versions 0.11.2 and below. The flaw allows an attacker to impersonate any user, including administrators, by exploiting the SSH handshake process. Specifically, the vulnerability arises because the victim's public key is 'offered' during the SSH handshake and the user identity is stored in the session context prematurely. If the attacker fails to authenticate with the victim's key but then authenticates with their own valid key, the session context is not cleared, allowing the attacker to assume the victim's identity. This vulnerability has a high CVSS 4.0 score of 8.1 and does not require authentication or user interaction to exploit. The issue was fixed in version 0.
A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.