CVE-2026-114277 is an authentication bypass vulnerability in Apache OFBiz's optional Janrain Engage Social Login integration within the ecommerce component. The flaw arises from improperly binding authenticated external identities to local user accounts, allowing bypass of authentication. This affects Apache OFBiz versions before 24.09.08. The issue is fixed in version 24.09.08.
CVE-2026-80092 is an authentication bypass vulnerability in Microsoft Identity Web that allows an authorized attacker to elevate privileges over a network. The issue arises from assumed-immutable data that can be manipulated to bypass authentication controls. This vulnerability affects versions from 1.0.0 up to, but not including, 4.16.1. Microsoft has released an official fix in version 4.16.1.
An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.
Weblate versions prior to 2026.8 contain an authentication bypass vulnerability where an authenticated user can change their account's primary email without verifying the new address. This allows acceptance of team invitations sent to the new email without access to the intended recipient's mailbox. The issue is fixed in version 2026.8.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request.
The @neo4j/graphql library versions prior to 7.5.6 and 5.12.14 have an authentication bypass vulnerability. The library fails to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. This allows unauthenticated remote clients to forge arbitrary JWT claims and be accepted as authenticated identities, enabling unauthorized access to subscription events restricted to specific roles or users. Versions 6.x are end-of-life and will not receive a fix.
DroneAware's centralized server was vulnerable to an account pre-hijacking flaw allowing attackers to register accounts with victim emails and attacker-chosen passwords before the victim activated their account. When the victim later activated the account, the attacker-set password remained valid, enabling silent account takeover without notification. The issue was fixed server-side on 2025-05-20, requiring no user action. Node binaries and self-hosted detection nodes are unaffected. No client-side mitigations or workarounds are needed.
Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations. This allowed Full Access to the following: all parts of Postiz, including users registered to the specific instance and the ability to post in the name of the victim's social media channels added to that Postiz instance. This issue has been fixed in version 2.21.8.
NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.
eLabFTW versions up to 5.4.1 contain an authentication bypass vulnerability where the multi-factor authentication (MFA) state is not reliably preserved during login. This flaw allows an attacker with valid primary credentials to bypass the second factor by using an attacker-controlled TOTP secret, potentially leading to unauthorized account access. The issue is resolved in version 5.4.2.
WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(), and the attacker-controlled value is then interpolated directly into a raw SQL query, allowing any authenticated user to query the database under an arbitrary identity. Version 3.6.10 fixes the issue.
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place. This allows anyone who can access the root shard to read and write to the cache server. This vulnerability is fixed in 0.30.3 and 0.29.3.
An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to unauthorized access. An attacker can modify a local database to trigger this vulnerability.
Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information.
This issue affects Brokerage Automation: before 1.1.71.