CVE-2026-19121 is an authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient verification of tenant context against the authenticated user, potentially allowing an attacker with valid credentials to access resources belonging to other tenants. This vulnerability has a high severity rating with a CVSS score of 8.3.
CVE-2026-18838 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient verification of identity information supplied in requests, allowing a remote attacker to impersonate other users. This can lead to unauthorized access to sensitive information and modification of API configurations.
CVE-2026-17290 is an authentication bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to create unauthorized user accounts by exploiting improper verification of cryptographic signatures. Specifically, identity information from a login provider is accepted without full signature verification, enabling forged identity data to be used for account creation.
CVE-2026-17278 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data by exploiting insufficient verification of client-supplied information. This enables the attacker to impersonate a trusted party without proper authentication.
CVE-2026-17172 is an authentication bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw arises because the client-supplied information is not properly verified, allowing a remote authenticated attacker to impersonate another party and bypass security restrictions.
CVE-2026-116790 is an authentication bypass vulnerability in FreeSWITCH prior to version 1.11.2. The flaw involves the inbound ICE handling accepting all connectivity checks without verifying the STUN MESSAGE-INTEGRITY attribute cryptographically. This allows an attacker on the network to spoof ICE connectivity checks, nominate their own address, redirect RTP and DTLS traffic, and terminate the legitimate media path. Unencrypted media legs are vulnerable to eavesdropping and media injection. The issue affects all WebRTC and SIP legs that negotiate ICE. The vulnerability is fixed in FreeSWITCH version 1.11.2 by enabling ice_verify_message_integrity=true.
CVE-2026-123033 is an authentication bypass vulnerability in the HA heartbeat origin check of middlewared in iXsystems TrueNAS SCALE versions before 25.10.8. An attacker on the same network segment can gain unauthenticated full-administrator API access and execute commands as root by exploiting the unconditional registration of the HA peer-authentication hook. The vulnerability affects even non-HA, unlicensed, single-node Community Edition installations. The issue is fixed in version 25.10.8 by requiring connections to terminate on the HA heartbeat listener, which the attacker cannot control.
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063.
X509Authenticator extracts the user identifier from the Subject DN (Distinguished Name) that the web server passes in $_SERVER['SSL_CLIENT_S_DN']. The fix for CVE-2026-45063 anchored that extraction to an RDN (Relative Distinguished Name) boundary, but the regular expression used was not escape-aware. The expression runs against an already serialized DN, so it cannot tell an RDN separator from a separator character that occurs inside a value. Under RFC 2253, used by Apache and by nginx's $ssl_client_s_dn, a comma inside a value is escaped as \, and the expression reads it as a separator regardless. RFC 2253 also does not treat / as a separator, so it leaves it bare inside a value, while the expression treats every / as one. The legacy X509_NAME_oneline() format, used by Apache's LegacyDNStringFormat and by nginx's $ssl_client_s_dn_legacy, is the mirror image: it escapes / as \/ and leaves , bare. In that format, a certificate with no emailAddress attribute, or whose poisoned CN precedes it, authenticates as the smuggled address.
To cover both RFC 2253 and the legacy X509_NAME_oneline() format, X509Authenticator and X509AuthenticationListener now split the DN into RDNs before looking for the attribute, instead of matching the attribute against the serialized string. They select the separator from the serialization, split on unescaped occurrences of that separator only, unescape each RDN afterwards with the rules of its format, and require the attribute to span a whole RDN. The accepted value grammar is unchanged.
Applications that pass a per-attribute user key (such as SSL_CLIENT_S_DN_Email) and deployments whose CA generates or validates the subject are not affected by this vulnerability.
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering, Denial of Service and Spoofing of Application Notifications.
CVE-2026-117656 is an authentication bypass vulnerability in the Sign in with Apple strategy of the pow-auth Assent library. It allows an unauthenticated remote attacker to impersonate another user by manipulating the user parameter in the authorization callback. The vulnerability arises because the user parameter, which is controlled by the client, is merged over verified ID token claims without proper validation, enabling attackers to replace critical identity claims such as subject and email. This affects versions from 0.1.25 up to but not including 0.3.2. The issue is fixed in version 0.3.2.
CVE-2026-63115 is an authentication bypass vulnerability in TryGhost's ActivityPub server versions 1.0.0 through 1.2.5. The flaw allows a remote federated server to spoof activities in the Undo handler, causing the service to act on follow or repost actions as if they originated from a different account. This can remove existing follow relationships or reposts without the account owner's involvement. No private data is exposed, and content is not altered. The issue is fixed in version 1.2.6.
CVE-2026-104623 is an authentication bypass vulnerability in SUSE Rancher Manager versions 2.11.0 up to 2.11.19, 2.12.0 up to 2.12.15, 2.13.0 up to 2.13.11, 2.14.0 up to 2.14.7, and 2.15.0 up to 2.15.3. The flaw exists in the authorization handling of the local management cluster shell feature, where some API routes bypass the intended access checks. This allows any authenticated user to run a pod on the management cluster without proper authorization. The vulnerability has a medium severity with a CVSS score of 6.3. Fixed versions are available for all affected release lines.
CVE-2026-104615 is an authentication bypass vulnerability in SUSE Rancher Fleet's cluster registration flow. It allows a registration request to claim a cluster identity without proper binding to the registration token, potentially enabling unauthorized association with a different managed cluster's identity. This flaw affects multiple versions of SUSE Rancher Fleet prior to fixed releases.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an authentication bypass vulnerability due to spoofing. An unauthenticated attacker with adjacent network access could exploit this flaw to steal sessions. The vulnerability is fixed in version 4.8.0 and later.
Echo, a Go web framework, has an authentication bypass vulnerability in versions 4.0.0 through 5.0.x where the Context.RealIP method falls back to client-supplied X-Forwarded-For or X-Real-IP headers if Echo.IPExtractor is unset. This allows remote attackers to manipulate forwarded IP addresses to bypass IP-based rate limiting controls. The issue is fixed in Echo version 5.1.0.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an authentication bypass vulnerability by spoofing. This flaw allows a low privileged remote attacker to potentially cause denial of service. The vulnerability is identified as CWE-290 and has a CVSS score of 6.4 (medium severity). Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and various LTS releases contain an authentication bypass vulnerability via spoofing. This flaw allows a low privileged remote attacker to potentially elevate privileges and impact other managed Data Domain systems. The vulnerability is identified as CWE-290 and has a critical CVSS score of 9.1. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively.