CVE-2026-102344 is a vulnerability in the lavish-axi loopback HTTP server prior to version 0.1.43. The server did not authenticate requests or validate Host and Origin headers on several routes, enabling DNS rebinding attacks. This allows an attacker-controlled website to send same-origin requests to the local service, leading to unauthorized file disclosure and manipulation of active agent sessions. The flaw is fixed in version 0.1.43.
A vulnerability in undici HTTP client for Node.js versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 allows a shared cache to serve an authenticated response to an unauthenticated caller due to improper origin validation during redirect and cache revalidation. This occurs when a cached response is revalidated with a 304 Not Modified status from a different origin, causing undici to incorrectly treat the response as valid. The issue is fixed in versions 7.30.2 and 8.12.4. Users should upgrade to these versions or later or apply recommended workarounds to mitigate the risk.
undici, an HTTP client for Node.js, has a vulnerability in versions 7.30.1 and 8.12.2 through 8.12.3 where origin validation during caching of redirected responses is flawed. This allows an attacker controlling a redirect target from a trusted URL to poison cached entries or cause private responses to be served to other users. The issue arises because the client inspects only the final redirect hop for caching decisions, ignoring intermediate hops that may affect cache validity. The vulnerability is fixed in versions 7.30.2 and 8.12.4.
CVE-2026-119344 is a critical origin validation error in the Cocos AI confidential computing system versions 0.8.2 and earlier. The vulnerability allows a remote attacker controlling another trusted platform to substitute valid attestation Evidence, causing authorization of an incorrect platform. This flaw arises because the system accepts attestation Evidence without binding it to a unique platform owner or enforcing revocation. The issue is addressed in version 0.9.0, but cannot be fully mitigated by source code changes alone due to the underlying confidential computing threat model.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured. A remote unauthenticated client can supply a forged Host header, creating a host header injection risk in applications whose web framework does not verify incoming host headers. Applications using appropriately configured Rails host authorization or a fixed full_host are not affected by this path. This issue is fixed in version 2.2.0.
SharpEmu versions up to 0.0.3-release.3 are vulnerable due to missing authentication on its debugger frontend HTTP API running on localhost. This API lacks validation of critical headers and accepts cross-origin requests, allowing attackers with local network access to perform debugger operations, launch executables, and initiate outbound connections. The vulnerability is fixed in version 0.0.3-release.3-patch.1.
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.
Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR registry with an unanchored regular expression, so any hostname containing .azurecr.io, .azurecr.cn, .azurecr.de or .azurecr.us is accepted. kaniko consults this helper for any registry that has no credentials in the Docker config and is not a Google or Amazon ECR registry, before contacting the registry. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img or COPY --from=<image>, causes the helper to obtain a token from the build's Azure identity (service principal environment variables, federated workload identity token, or managed identity) and POST it to https://<host>/oauth2/exchange. The attacker can use the token against Azure Resource Manager with the identity's role assignments until it expires, and can exchange it for credentials to any ACR registry the identity can access. No RUN instruction or push is required. This issue is fixed in 1.25.20.
Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state.
The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state.
A local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account.
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.
A vulnerability in the Fiber web framework versions 2.52.1 and 2.52.2 affects the CORS middleware's domain validation. The issue arises from improper origin validation where the wildcard matcher strips the scheme and only checks host suffixes without requiring a dot boundary. This can allow an attacker-controlled origin with a host ending in the configured base domain to bypass restrictions when AllowCredentials is enabled, potentially exposing authenticated cross-origin responses. The vulnerability is fixed in version 2.52.3.
CVE-2026-61546 is a high-severity origin validation error in the ankimcp anki-mcp-server-addon prior to version 0.21.0. The vulnerability arises because FastMCP DNS-rebinding protection is globally disabled, including for the default local HTTP listener on 127.0.0.1:3141. This allows a malicious web page visited by a user running Anki with the listener active to perform unauthorized MCP operations such as initializing MCP, enumerating tools, reading the local collection, and performing non-destructive note and deck modifications without requiring local network access or credentials. The issue is fixed in version 0.21.0.
Echo, a Go web framework, had a vulnerability in versions prior to 4.16.0 and 5.4.0 where it trusted forwarded scheme headers from any client. This allowed an attacker to bypass HTTPSRedirect by claiming an HTTPS scheme over plaintext HTTP or suppress the Strict-Transport-Security header behind a TLS-terminating proxy. The issue is fixed in versions 4.16.0 and 5.4.0.
A vulnerability in the Echo Go web framework versions 4.0.0 through 5.3.9 allows an attacker to spoof the client IP address forwarded to upstream services via the X-Real-IP header when the Proxy middleware is used without configuring Echo.IPExtractor. This can undermine IP-based access controls, rate limiting, audit logging, or geographic restrictions relying on the forwarded IP. The issue is fixed in Echo version 5.4.0.
CVE-2026-115413 is a vulnerability in AWS aws-api-mcp-server versions 1.3.0 up to but not including 1.6.0. It involves missing token audience validation in the OAuth authentication mode, which could allow local users to perform AWS operations using the server's AWS credentials via an access token issued to another application by the same identity provider. The issue is fixed in version 1.6.0 by adding the ability to configure the expected token audience or client ID.
An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.