# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Improper authentication in Dell Power Protect Cyber Recovery and others](https://agentprime.io/advisories/CVE-2026-79938.md)
  `CVE-2026-79938` · CVE record: Dell Power Protect Cyber Recovery and 1 more · CVSS 7.6 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests](https://agentprime.io/advisories/CVE-2026-47837.md)
  `CVE-2026-47837` · CVE record: Spring Spring Cloud Config · CVSS 6.8 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration](https://agentprime.io/advisories/CVE-2026-81032.md)
  `CVE-2026-81032` · CVE record: vesoft-inc nebula · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Authentication Bypass Using an Alternate Path or Channel in GitLab](https://agentprime.io/advisories/CVE-2026-3035.md)
  `CVE-2026-3035` · CVE record: GitLab GitLab · CVSS 5.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter](https://agentprime.io/advisories/CVE-2026-80349.md)
  `CVE-2026-80349` · CVE record: TarsCloud TarsWeb · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS](https://agentprime.io/advisories/CVE-2026-19538.md)
  `CVE-2026-19538` · CVE record: NLnet Labs NSD · CVSS 8.2 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass, CWE-672
- [CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication](https://agentprime.io/advisories/CVE-2026-80234.md)
  `CVE-2026-80234` · CVE record: CAYIN Technology CAYIN CMS-WS and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Insecure PIN derivation mechanism in Admin By Request (ABR)](https://agentprime.io/advisories/CVE-2026-78236.md)
  `CVE-2026-78236` · CVE record: Admin By Request (ABR) Admin By Request (ABR) · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control, Authentication bypass, Weak cryptography or TLS
- [BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery](https://agentprime.io/advisories/CVE-2026-19718.md)
  `CVE-2026-19718` · CVE record: Unknown BlogVault Backup & Staging and 2 more · CVSS 8.1 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch](https://agentprime.io/advisories/CVE-2026-14216.md)
  `CVE-2026-14216` · CVE record: Unknown Booking for Appointments and Events Calendar · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Unauthorized credential switching](https://agentprime.io/advisories/CVE-2026-58092.md)
  `CVE-2026-58092` · CVE record: FreeBSD FreeBSD · CVSS 8.1 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability](https://agentprime.io/advisories/GHSA-9xv2-5v5q-p794.md)
  `GHSA-9xv2-5v5q-p794`, `BIT-tomcat-2026-65905`, `CVE-2026-65905` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.25 || >=10.1.0-M1, <10.1.58 || >=9.0.0.M1, <9.0.121 || >=8.5.0, <=8.5.100 || >=7.0.30, <=7.0.109`, fixed in `11.0.25`, `10.1.58`, `9.0.121` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism.](https://agentprime.io/advisories/CVE-2026-75329.md)
  `CVE-2026-75329` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/\*\*' parameters.](https://agentprime.io/advisories/CVE-2026-75325.md)
  `CVE-2026-75325` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the…](https://agentprime.io/advisories/CVE-2025-61480.md)
  `CVE-2025-61480` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass, Race condition, Denial of service, CWE-354
- [An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepts replayed…](https://agentprime.io/advisories/CVE-2025-61479.md)
  `CVE-2025-61479` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass](https://agentprime.io/advisories/CVE-2026-80192.md)
  `CVE-2026-80192` · CVE record: better-auth sso · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay](https://agentprime.io/advisories/CVE-2026-41707.md)
  `CVE-2026-41707` · CVE record: Spring Spring Security · CVSS 7.4 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081](https://agentprime.io/advisories/CVE-2026-16639.md)
  `CVE-2026-16639` · CVE record: Drupal Internationalization Single Sign-On · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [PanKM - Critical - Unsupported - SA-CONTRIB-2026-083](https://agentprime.io/advisories/CVE-2026-16646.md)
  `CVE-2026-16646` · CVE record: Drupal PanKM · CVSS 5.7 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110](https://agentprime.io/advisories/CVE-2026-18260.md)
  `CVE-2026-18260` · CVE record: Drupal Disable Login Page · CVSS 5.7 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-20
- [Apache Tomcat: Authenticated WebSocket session survives end of HTTP session](https://agentprime.io/advisories/CVE-2026-73180.md)
  `CVE-2026-73180` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 6.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Apache Tomcat: Principal lookup can fail open in some cases](https://agentprime.io/advisories/CVE-2026-68569.md)
  `CVE-2026-68569` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [TypeBot: Account takeover via brute-forceable 6-digit magic-link code](https://agentprime.io/advisories/CVE-2026-62862.md)
  `CVE-2026-62862` · CVE record: baptisteArno typebot.io · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session](https://agentprime.io/advisories/CVE-2026-78655.md)
  `CVE-2026-78655` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-642
- [Missing authentication in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65105.md)
  `CVE-2026-65105` · CVE record: NVIDIA NemoClaw · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Weak authentication in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65098.md)
  `CVE-2026-65098` · CVE record: NVIDIA NemoClaw · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint](https://agentprime.io/advisories/GHSA-72f3-6w86-7rv3.md)
  `GHSA-72f3-6w86-7rv3`, `CVE-2026-55605` · npm `@arikusi/deepseek-mcp-server`: affected `>=1.4.2, <1.8.0`, fixed in `1.8.0` · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature](https://agentprime.io/advisories/CVE-2026-79787.md)
  `CVE-2026-79787` · CVE record: Alluxio alluxio · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching](https://agentprime.io/advisories/GHSA-777c-2fxx-qr28.md)
  `GHSA-777c-2fxx-qr28`, `CVE-2026-49757`, `EEF-CVE-2026-49757` · Hex `ash_authentication`: affected `>=0.1.0, <4.14.0 || >=5.0.0-rc.0, <5.0.0-rc.10`, fixed in `4.14.0`, `5.0.0-rc.10` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Improper authentication in NVIDIA Unified Fabric Manager Enterprise - GA and others](https://agentprime.io/advisories/CVE-2026-24170.md)
  `CVE-2026-24170` · CVE record: NVIDIA Unified Fabric Manager Enterprise - GA and 3 more · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls](https://agentprime.io/advisories/GHSA-xx4j-w367-7247.md)
  `GHSA-xx4j-w367-7247`, `CVE-2026-55571`, `PYSEC-2026-3829` · PyPI `djust`: affected `<1.0.4`, fixed in `1.0.4` · CVSS 8.2 High · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control, Authentication bypass
- [nextcloud-mcp-server: Unauthenticated \`POST /webhooks/nextcloud\` allows arbitrary vector data deletion when \`WEBHOOK_SECRET\` is unset ( default )](https://agentprime.io/advisories/GHSA-8vh3-g2qg-2h2c.md)
  `GHSA-8vh3-g2qg-2h2c`, `CVE-2026-55640`, `PYSEC-2026-3866` · PyPI `nextcloud-mcp-server`: affected `<0.117.2`, fixed in `0.117.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret](https://agentprime.io/advisories/GHSA-gfq8-hmph-9gjv.md)
  `GHSA-gfq8-hmph-9gjv`, `CVE-2026-55533`, `PYSEC-2026-3889` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 8.2 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [PraisonAI: \[Auth Bypass\] PraisonAI async Jobs API (\`/api/v1/runs\`) has no authentication — unauthenticated job execution, result theft, cancel and delete](https://agentprime.io/advisories/GHSA-2jgc-f764-c5r2.md)
  `GHSA-2jgc-f764-c5r2`, `CVE-2026-55539`, `PYSEC-2026-3885` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [PraisonAI: \[Auth Bypass\] \`praisonai serve agents --api-key\` is silently ignored — agent-invocation routes (\`POST /agents\`, \`POST /agents/{agent_name}\`) run unauthenticated](https://agentprime.io/advisories/GHSA-r7v3-x45f-g7hp.md)
  `GHSA-r7v3-x45f-g7hp`, `CVE-2026-55538`, `PYSEC-2026-3894` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 7.3 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution](https://agentprime.io/advisories/GHSA-7ww9-85pg-cv4x.md)
  `GHSA-7ww9-85pg-cv4x`, `CVE-2026-55534`, `PYSEC-2026-3887` · PyPI `praisonai`: affected `>=4.6.34, <4.6.58`, fixed in `4.6.58` · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [praisonaiagents: AgentServer declares auth_token but never enforces it on any route](https://agentprime.io/advisories/GHSA-7g3p-92qq-8wvh.md)
  `GHSA-7g3p-92qq-8wvh`, `CVE-2026-55528`, `PYSEC-2026-3899` · PyPI `praisonaiagents`: affected `<1.6.58`, fixed in `1.6.58` · CVSS 8.2 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, Broken access control
- [PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server](https://agentprime.io/advisories/GHSA-wj6g-v78p-6fx3.md)
  `GHSA-wj6g-v78p-6fx3`, `CVE-2026-55529`, `PYSEC-2026-3896` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-346
- [liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication](https://agentprime.io/advisories/CVE-2026-78885.md)
  `CVE-2026-78885` · CVE record: liketrek TREK · CVSS 6.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [WatchGuard Agent improper authentication allows unauthenticated remote code execution](https://agentprime.io/advisories/CVE-2026-57910.md)
  `CVE-2026-57910` · CVE record: WatchGuard WatchGuard Agent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-494
- [WatchGuard Agent path traversal allows unauthenticated remote code execution](https://agentprime.io/advisories/CVE-2026-57909.md)
  `CVE-2026-57909` · CVE record: WatchGuard WatchGuard Agent · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Code injection, Authentication bypass
- [liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication](https://agentprime.io/advisories/CVE-2026-78863.md)
  `CVE-2026-78863` · CVE record: liketrek TREK · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user](https://agentprime.io/advisories/CVE-2026-53561.md)
  `CVE-2026-53561` · CVE record: Apache Software Foundation Apache Hive · CVSS 7.4 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-305, CWE-345
- [Polkit authentication bypass in LACT](https://agentprime.io/advisories/CVE-2026-75037.md)
  `CVE-2026-75037` · CVE record: ilya-zlobintsev LACT · CVSS 7.3 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)](https://agentprime.io/advisories/PKSA-xf71-q2f9-j6qg.md)
  `PKSA-xf71-q2f9-j6qg`, `CVE-2026-77130` · Packagist `syssy/syssy-typo3-extension`: affected `<3.0.6`, fixed in `3.0.6` · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [SMS Password Authorization Bypass via Failed Attempt Counter](https://agentprime.io/advisories/CVE-2026-63587.md)
  `CVE-2026-63587` · CVE record: Weidmueller Interface IE-SR-2TX-WL-4G-EU and 1 more · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Purpose-limited JWT accepted as full bearer authentication in AshAuthentication](https://agentprime.io/advisories/GHSA-6vcj-3h59-rrc3.md)
  `GHSA-6vcj-3h59-rrc3`, `CVE-2026-65633`, `EEF-CVE-2026-65633` · Hex `ash_authentication`: affected `>=3.10.5, <4.14.2 || >=5.0.0-rc.0, <5.0.0-rc.13`, fixed in `4.14.2`, `5.0.0-rc.13` · CVSS 7.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Missing authentication in FURUNO ELECTRIC CO., LTD. FA-50](https://agentprime.io/advisories/CVE-2026-67578.md)
  `CVE-2026-67578` · CVE record: FURUNO ELECTRIC CO., LTD. FA-50 · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method](https://agentprime.io/advisories/CVE-2026-75575.md)
  `CVE-2026-75575` · CVE record: RocketChat Rocket.Chat · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-204
- [WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-78259.md)
  `CVE-2026-78259` · CVE record: WP Legal Pages WPLegalPages · CVSS 7.3 High · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication](https://agentprime.io/advisories/CVE-2026-78434.md)
  `CVE-2026-78434` · CVE record: Faveo Helpdesk · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [CakePHP: Potential Authentication bypass with CookieAuthenticator](https://agentprime.io/advisories/CVE-2026-77337.md)
  `CVE-2026-77337` · CVE record: cakephp authentication · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, Denial of service
- [Explicit organization scopes survive token refresh after membership ends](https://agentprime.io/advisories/CVE-2026-75554.md)
  `CVE-2026-75554` · CVE record: hexpm hexpm · CVSS 2.3 Low · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)](https://agentprime.io/advisories/CVE-2026-75509.md)
  `CVE-2026-75509` · CVE record: authlib joserfc · CVSS 6.5 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, CWE-345
- [RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts](https://agentprime.io/advisories/CVE-2026-78551.md)
  `CVE-2026-78551` · CVE record: ransomlook ransomlook · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, Denial of service
- [Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted](https://agentprime.io/advisories/GHSA-fpm2-m4qq-wghr.md)
  `GHSA-fpm2-m4qq-wghr`, `CVE-2026-66908` · Maven `org.apache.camel:camel-platform-http-main`: affected `>=4.8.0, <4.22.0`, fixed in `4.22.0` · CVSS 7.5 High · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php](https://agentprime.io/advisories/CVE-2026-77915.md)
  `CVE-2026-77915` · CVE record: rconfig rconfig · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, CWE-1188
- [HCL Hive is affected by a missing rate limit](https://agentprime.io/advisories/CVE-2026-21755.md)
  `CVE-2026-21755` · CVE record: HCLSoftware HCL Hive · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [Authentication bypass between ZCC and client connector portal](https://agentprime.io/advisories/CVE-2026-59564.md)
  `CVE-2026-59564` · CVE record: Zscaler Client Connector · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA4LTI0VDEzOjM5OjE2LjA2MzAwMFoiLCJDVkUtMjAyNi01OTU2NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA4LTI2VDE5OjUzOjI5LjE2MDAwMFoiLCJDVkUtMjAyNi03NTYwMSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA4LTI2VDE5OjUzOjI5LjE2MDAwMFoiLCJDVkUtMjAyNi03NTYwMSJd>. Everything for agents: <https://agentprime.io/llms.txt>.