Threats Tagged 'cwe-302'

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. Any authenticated tenant can inject X-Remote-Group: system:masters, authorization.kcp.io/warrant, authentication.kcp.io/scopes, or a group used for per-workspace required-group gating, and the shard trusts these values as authenticated identity assertions. This allows cross-workspace impersonation, authorization bypass, and arbitrary reading, writing, or deletion of resources, secrets, RBAC data, APIExports, APIBindings, and LogicalClusters. This issue is fixed in versions 0.31.4 and 0.32.2.

Weblate versions prior to 2026.8 contain an authentication bypass vulnerability where an authenticated user can change their account's primary email without verifying the new address. This allows acceptance of team invitations sent to the new email without access to the intended recipient's mailbox. The issue is fixed in version 2026.8.

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request.

The @neo4j/graphql library versions prior to 7.5.6 and 5.12.14 have an authentication bypass vulnerability. The library fails to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. This allows unauthenticated remote clients to forge arbitrary JWT claims and be accepted as authenticated identities, enabling unauthorized access to subscription events restricted to specific roles or users. Versions 6.x are end-of-life and will not receive a fix.

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

DroneAware's centralized server was vulnerable to an account pre-hijacking flaw allowing attackers to register accounts with victim emails and attacker-chosen passwords before the victim activated their account. When the victim later activated the account, the attacker-set password remained valid, enabling silent account takeover without notification. The issue was fixed server-side on 2025-05-20, requiring no user action. Node binaries and self-hosted detection nodes are unaffected. No client-side mitigations or workarounds are needed.

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations. This allowed Full Access to the following: all parts of Postiz, including users registered to the specific instance and the ability to post in the name of the victim's social media channels added to that Postiz instance. This issue has been fixed in version 2.21.8.

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.

CVE-2025-43992 is a medium severity vulnerability affecting Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0.