Threats Tagged 'cwe-305'

Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.check_user/2 decides whether the attribute named by require_confirmed_with is set using a bare is_nil(Map.get(user, value)). When that attribute is not selected on the loaded record Map.get/2 returns %Ash.NotLoaded{}, and when a field policy denies it for the current actor it returns %Ash.ForbiddenField{}. Neither is nil, so the rejection branch is skipped and sign-i require_confirmed_with is enforced in two places, and neither holds in every configuration. sign_in_with_token and register are checked only inside AshAuthentication.Strategy.Password.Actions, not on the action itself, so any caller that invokes the action directly skips the check. An API layer such as AshGraphql or AshJsonApi invokes the action directly, so this applies to the default configuration. Where a check does run it compares the confirmation attribute against nil. That attribute holds %Ash.NotLoaded{} or %Ash.ForbiddenField{} when it sets select_by_default?: false, when an API layer narrows the read's select, or when a field policy hides it from the sign-in actor. Neither struct is nil, so those configurations read every user as confirmed. This issue affects ash_authentication: from 4.3.8 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

In late August 2026, a sophisticated device code phishing campaign was identified, distributed through web contact forms. Threat actors impersonated procurement officers from legitimate businesses, specifically BJ's Wholesale Club, using lookalike domains registered with Zoho Mail. The campaign, tracked as GhostCode, abused Microsoft's OAuth 2.0 device authorization grant flow to obtain authentication tokens. Victims received WeTransfer links to password-protected HTML files containing three layers of obfuscation: junk padding, character-level HTML comment injection, and AES-256-GCM encrypted redirect URLs. After passing multiple security checks including Cloudflare Turnstile, victims were directed to legitimate Microsoft sign-in pages where they unwittingly authorized attacker-controlled devices. Within 78 seconds of successful authentication, threat actors registered three devices, obtained Primary Refresh Tokens, and harvested emails using residential proxy rotation to evade detection.

An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs

CVE-2026-86207 is a high-severity authentication bypass vulnerability in N-able N-central versions prior to 2026.3.1.13. The flaw allows bypassing authentication in internal-only APIs due to a primary weakness classified as CWE-305. This vulnerability could enable unauthorized access to internal API functions.

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

CVE-2026-16895 is a logic vulnerability in the Rapid7 Metasploit Framework's JSON-RPC web service interface. It arises when an exception during the database health check causes the internal authentication state to reset improperly if a specific environment variable is not set. This leads to an authentication bypass, granting unauthenticated local access to the JSON-RPC request dispatcher.

CVE-2026-16895 is a logic vulnerability in the Rapid7 Metasploit Framework's JSON-RPC web service interface. The flaw arises when an exception during a database health check causes the internal authentication state to reset improperly, allowing unauthenticated local access. This occurs if the environment variable MSF_WS_JSON_RPC_API_TOKEN is not set, leading the authentication mechanism to mistakenly allow access without credentials. The vulnerability affects versions prior to 6.5.2 and has a medium severity rating.

Punk::Plugin::TOTP versions before 0.05 for Perl contain an authentication bypass vulnerability in the two-factor authentication process. The vulnerability arises because the recovery code verification compares user identifiers numerically, causing identifiers without leading digits to coerce to zero and bypass ownership checks. This allows an attacker who knows a victim's password and has their own recovery code to bypass the victim's second factor and authenticate as the victim.

An improper authentication vulnerability exists in Apache Hive versions 4.0.0 through 4.2.0 when using HiveServer2 with SAML authentication over HTTP transport. This flaw allows an unauthenticated attacker with network access to the HiveServer2 HTTP port to impersonate any Hive user by sending a forged Authorization: Bearer token to the /cliservice endpoint. No Hive credentials, SAML IdP login, or server signing secret knowledge is required. The vulnerability does not affect deployments where Apache Knox handles SSO and HiveServer2 uses LDAP or Kerberos authentication.

CVE-2026-19349 is a critical authentication bypass vulnerability in Lemonldap::NG::Portal affecting certain versions that use the GitHub and LinkedIn OAuth2 backends. The flaw allows an unauthenticated visitor to replay a session identifier used as an OAuth2 state parameter to gain a valid SSO session without proper authentication. This occurs because the state parameter is stored as a regular SSO session lacking user and authentication level attributes, which some default configurations accept. Only deployments with the GitHub or LinkedIn authentication modules enabled are affected.