MinIO contains two authentication bypass vulnerabilities in its STREAMING-UNSIGNED-PAYLOAD-TRAILER code path that allow an attacker with a valid access key to write arbitrary objects to any bucket without a valid cryptographic signature. The first vulnerability is due to missing signature verification in the PutObjectExtractHandler, and the second is a signature verification bypass via query-string credentials. These issues affect all MinIO releases starting from RELEASE.2023-05-18T00-05-36Z through the final open-source release. A fix is available in MinIO AIStor RELEASE.2026-04-11T03-20-12Z.