# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [FlexNet Beacon Missing Authentication Vulnerability](https://agentprime.io/advisories/CVE-2026-110390.md)
  `CVE-2026-110390` · CVE record: Flexera FlexNet Beacon and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Information disclosure
- [Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint](https://agentprime.io/advisories/CVE-2026-111493.md)
  `CVE-2026-111493` · CVE record: TPC Software Matchpoint · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions](https://agentprime.io/advisories/CVE-2026-103020.md)
  `CVE-2026-103020` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Authentication bypass
- [FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY](https://agentprime.io/advisories/CVE-2026-116790.md)
  `CVE-2026-116790` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server](https://agentprime.io/advisories/CVE-2026-123208.md)
  `CVE-2026-123208` · CVE record: libnoname noname · CVSS 7.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key](https://agentprime.io/advisories/CVE-2026-123206.md)
  `CVE-2026-123206` · CVE record: aozorae EdgeChat · CVSS 6.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority](https://agentprime.io/advisories/CVE-2026-97847.md)
  `CVE-2026-97847` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover](https://agentprime.io/advisories/CVE-2026-97175.md)
  `CVE-2026-97175` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession](https://agentprime.io/advisories/CVE-2026-92855.md)
  `CVE-2026-92855` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growth](https://agentprime.io/advisories/CVE-2026-49407.md)
  `CVE-2026-49407` · CVE record: tinyhumansai openhuman · CVSS 7.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Denial of service
- [OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token](https://agentprime.io/advisories/CVE-2026-49393.md)
  `CVE-2026-49393` · CVE record: tinyhumansai openhuman · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data](https://agentprime.io/advisories/CVE-2026-49405.md)
  `CVE-2026-49405` · CVE record: tinyhumansai openhuman · CVSS 6.2 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Authentication bypass
- [Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authentication](https://agentprime.io/advisories/CVE-2026-121139.md)
  `CVE-2026-121139` · CVE record: Rapid7 Metasploit Framework · CVSS 7.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Cendio ThinLinc Improper Authentication via Web Access](https://agentprime.io/advisories/CVE-2026-119744.md)
  `CVE-2026-119744` · CVE record: Cendio ThinLinc · CVSS 7.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication](https://agentprime.io/advisories/CVE-2026-123032.md)
  `CVE-2026-123032` · CVE record: OpenBMB Internet of Agents · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Apache OFBiz: Unauthenticated path-suffix view authorization bypass](https://agentprime.io/advisories/CVE-2026-73577.md)
  `CVE-2026-73577` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact](https://agentprime.io/advisories/CVE-2026-73578.md)
  `CVE-2026-73578` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound](https://agentprime.io/advisories/CVE-2026-82907.md)
  `CVE-2026-82907` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation](https://agentprime.io/advisories/CVE-2026-92887.md)
  `CVE-2026-92887` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, CWE-1188
- [agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication](https://agentprime.io/advisories/CVE-2026-123024.md)
  `CVE-2026-123024` · CVE record: agentscope-ai AgentScope · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover](https://agentprime.io/advisories/CVE-2026-109928.md)
  `CVE-2026-109928` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in iXsystems TrueNAS SCALE](https://agentprime.io/advisories/CVE-2026-123033.md)
  `CVE-2026-123033` · CVE record: iXsystems TrueNAS SCALE · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in GodotSteam](https://agentprime.io/advisories/CVE-2026-123017.md)
  `CVE-2026-123017` · CVE record: godotsteam GodotSteam · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [OpenHands Landing missing authentication](https://agentprime.io/advisories/CVE-2026-122236.md)
  `CVE-2026-122236` · CVE record: OpenHands · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication](https://agentprime.io/advisories/CVE-2026-122049.md)
  `CVE-2026-122049` · CVE record: Campcodes Bitcoin Wallet System · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, CWE-799
- [VitaFit Cloud API Authentication Bypass via POST /front/login/sns/](https://agentprime.io/advisories/CVE-2026-54384.md)
  `CVE-2026-54384` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [GLPI: MFA bypass](https://agentprime.io/advisories/CVE-2026-52848.md)
  `CVE-2026-52848` · CVE record: glpi-project glpi · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure](https://agentprime.io/advisories/CVE-2026-54375.md)
  `CVE-2026-54375` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover](https://agentprime.io/advisories/CVE-2026-102894.md)
  `CVE-2026-102894` · CVE record: gpustack gpustack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin](https://agentprime.io/advisories/CVE-2026-102895.md)
  `CVE-2026-102895` · CVE record: gpustack gpustack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, CWE-346
- [Traccar: Authentication bypass via path parameters exposes protected device media](https://agentprime.io/advisories/CVE-2026-104203.md)
  `CVE-2026-104203` · CVE record: traccar traccar · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Authentication bypass
- [Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets](https://agentprime.io/advisories/CVE-2026-102340.md)
  `CVE-2026-102340` · CVE record: telepresenceio telepresence · CVSS 8.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Broken access control
- [BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass](https://agentprime.io/advisories/CVE-2026-122138.md)
  `CVE-2026-122138` · CVE record: blueprintue blueprintue-self-hosted-edition · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [WPO365 LOGIN before 45.2 SAML Replay Protection Bypass](https://agentprime.io/advisories/CVE-2026-122220.md)
  `CVE-2026-122220` · CVE record: wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again](https://agentprime.io/advisories/CVE-2026-113373.md)
  `CVE-2026-113373` · CVE record: Sonatype Nexus Repository 3 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication](https://agentprime.io/advisories/CVE-2026-121933.md)
  `CVE-2026-121933` · CVE record: Linksys E5350 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [DeepSeek Harness Unauthenticated RPC Command Execution](https://agentprime.io/advisories/CVE-2026-82033.md)
  `CVE-2026-82033` · CVE record: deepseek-ai deepseek-harness · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication](https://agentprime.io/advisories/CVE-2026-121926.md)
  `CVE-2026-121926` · CVE record: yezhihao jt808-server · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies](https://agentprime.io/advisories/CVE-2026-119746.md)
  `CVE-2026-119746` · CVE record: ProSoft Technology X35-HWC-A and 1 more · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, CWE-602
- [SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution](https://agentprime.io/advisories/CVE-2026-92704.md)
  `CVE-2026-92704` · CVE record: sharpemu sharpemu · CVSS 8.3 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-346, CWE-350
- [WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service](https://agentprime.io/advisories/CVE-2026-121639.md)
  `CVE-2026-121639` · CVE record: WatchGuard AuthPoint Authentication Gateway · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, CWE-252
- [WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions](https://agentprime.io/advisories/CVE-2026-121640.md)
  `CVE-2026-121640` · CVE record: WatchGuard AuthPoint Authentication Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses](https://agentprime.io/advisories/CVE-2026-119776.md)
  `CVE-2026-119776` · CVE record: frrouting frrouting · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking](https://agentprime.io/advisories/CVE-2026-121939.md)
  `CVE-2026-121939` · CVE record: David-Crty Databasement · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [CVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063](https://agentprime.io/advisories/PKSA-k1xt-28gt-fw9y.md)
  `PKSA-k1xt-28gt-fw9y`, `CVE-2026-118513` · Packagist `symfony/security-http`: affected `>=2.0.0, <3.0.0 || >=3.0.0, <4.0.0 || >=4.0.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `3.0.0`, `4.0.0`, `5.0.0`, `5.1.0`, `5.2.0`, `5.3.0`, `5.4.0`, `5.4.56`, `6.1.0`, `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [CVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063](https://agentprime.io/advisories/PKSA-8s76-qdyv-tvyf.md)
  `PKSA-8s76-qdyv-tvyf`, `CVE-2026-118513` · Packagist `symfony/symfony`: affected `>=2.0.0, <3.0.0 || >=3.0.0, <4.0.0 || >=4.0.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `3.0.0`, `4.0.0`, `5.0.0`, `5.1.0`, `5.2.0`, `5.3.0`, `5.4.0`, `5.4.56`, `6.1.0`, `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-57775.md)
  `CVE-2026-57775` · CVE record: RelyWP Simple Cloudflare Turnstile · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [About Time Technologies｜Herowatch Mini - Missing Authentication](https://agentprime.io/advisories/CVE-2026-121816.md)
  `CVE-2026-121816` · CVE record: About Time Technologies Herowatch Mini · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Linksys E5600 Login mesh_login.cgi improper authentication](https://agentprime.io/advisories/CVE-2026-121615.md)
  `CVE-2026-121615` · CVE record: Linksys E5600 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92188.md)
  `CVE-2026-92188` · CVE record: Quest Foglight for Databases · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Emerson Ovation Missing Authentication for Critical Functionality](https://agentprime.io/advisories/CVE-2022-29966.md)
  `CVE-2022-29966` · CVE record: Emerson Ovation · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creation](https://agentprime.io/advisories/CVE-2026-121736.md)
  `CVE-2026-121736` · CVE record: nocodb nocodb · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens](https://agentprime.io/advisories/CVE-2026-121735.md)
  `CVE-2026-121735` · CVE record: blueprintue blueprintue-self-hosted-edition · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication](https://agentprime.io/advisories/CVE-2026-121535.md)
  `CVE-2026-121535` · CVE record: miroslavpejic85 MiroTalk P2P · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass, CWE-799
- [CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)](https://agentprime.io/advisories/CVE-2026-22060.md)
  `CVE-2026-22060` · CVE record: NETAPP StorageGRID (formerly StorageGRID Webscale) · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Umami 2FA Policy route.ts single-factor authentication](https://agentprime.io/advisories/CVE-2026-121531.md)
  `CVE-2026-121531` · CVE record: Umami · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass, CWE-308
- [CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)](https://agentprime.io/advisories/CVE-2026-22058.md)
  `CVE-2026-22058` · CVE record: NETAPP StorageGRID (formerly StorageGRID Webscale) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data](https://agentprime.io/advisories/CVE-2026-63482.md)
  `CVE-2026-63482` · CVE record: yeti-platform yeti · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation](https://agentprime.io/advisories/CVE-2026-121501.md)
  `CVE-2026-121501` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Arc has unauthenticated application log disclosure via \`/api/v1/logs\`](https://agentprime.io/advisories/GHSA-m3qr-fvp4-78xj.md)
  `GHSA-m3qr-fvp4-78xj`, `GO-2026-6907` · Go `github.com/basekick-labs/arc`: affected `<0.0.0-20260615165136-bb7d9761ad98`, fixed in `0.0.0-20260615165136-bb7d9761ad98` · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure, Authentication bypass

Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTExLTAzVDE2OjI5OjM4LjAwMDAwMFoiLCJHSFNBLW0zcXItZnZwNC03OHhqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/>. Everything for agents: <https://agentprime.io/llms.txt>.