# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-77483.md)
  `CVE-2026-77483` · CVE record: Microsoft Microsoft SQL Server 2017 (CU 31) and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows iSCSI Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-73025.md)
  `CVE-2026-73025` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Autopilot Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-73004.md)
  `CVE-2026-73004` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Internet Connection Sharing (ICS) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-72964.md)
  `CVE-2026-72964` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Modern Device Management (MDM) Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69674.md)
  `CVE-2026-69674` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [aircheng-org iWebShop-5 systemseller.php login improper authentication](https://agentprime.io/advisories/CVE-2026-86669.md)
  `CVE-2026-86669` · CVE record: aircheng-org iWebShop-5 · CVSS 6.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Power Dependency Coordinator Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-69321.md)
  `CVE-2026-69321` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Netlogon Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-62759.md)
  `CVE-2026-62759` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Cloud Files Mini Filter Driver Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-83991.md)
  `CVE-2026-83991` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Microsoft Authenticator Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-80097.md)
  `CVE-2026-80097` · CVE record: Microsoft Microsoft Authenticator for Android · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Kerberos Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69676.md)
  `CVE-2026-69676` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Microsoft Windows Search Component Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-69554.md)
  `CVE-2026-69554` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows Shell Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69528.md)
  `CVE-2026-69528` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows DHCP Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69415.md)
  `CVE-2026-69415` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Azure Arc SQL Server Extension Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62895.md)
  `CVE-2026-62895` · CVE record: Microsoft Azure Arc SQL Server Extension · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: SQL injection, Authentication bypass, CWE-942
- [WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize](https://agentprime.io/advisories/CVE-2026-86729.md)
  `CVE-2026-86729` · CVE record: WWBN AVideo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [AVideo through 29.0 Unauthenticated Disclosure via epg.json.php](https://agentprime.io/advisories/CVE-2026-86728.md)
  `CVE-2026-86728` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [AVideo through 29.0 Information Disclosure via stats.json.php](https://agentprime.io/advisories/CVE-2026-86727.md)
  `CVE-2026-86727` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [AVideo LoginControl PGP Authentication Bypass via verifyChallenge](https://agentprime.io/advisories/CVE-2026-86723.md)
  `CVE-2026-86723` · CVE record: WWBN AVideo · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [AVideo Authentication Bypass via SQL Cache Invalidation](https://agentprime.io/advisories/CVE-2026-86722.md)
  `CVE-2026-86722` · CVE record: WWBN AVideo · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [AVideo through c3edcc274c Authorization Bypass via Session Cookie](https://agentprime.io/advisories/CVE-2026-86721.md)
  `CVE-2026-86721` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass in Ivanti Sentry](https://agentprime.io/advisories/CVE-2026-83527.md)
  `CVE-2026-83527` · CVE record: Ivanti Sentry · CVSS 8.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [XenForo < 2.3.13 Refresh Token Replay via Expired Access Token](https://agentprime.io/advisories/CVE-2026-73312.md)
  `CVE-2026-73312` · CVE record: XenForo XenForo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [XenForo < 2.3.13 OAuth2 Authorization Code Reuse](https://agentprime.io/advisories/CVE-2026-73311.md)
  `CVE-2026-73311` · CVE record: XenForo XenForo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [CommServe Information Disclosure](https://agentprime.io/advisories/CVE-2026-77103.md)
  `CVE-2026-77103` · CVE record: Commvault Commvault Cloud · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Private Metrics Server Denial of Service](https://agentprime.io/advisories/CVE-2026-77097.md)
  `CVE-2026-77097` · CVE record: Commvault Commvault Cloud · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Command Center API Authentication Bypass](https://agentprime.io/advisories/CVE-2026-77089.md)
  `CVE-2026-77089` · CVE record: Commvault Commvault Cloud · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass in Siemens Reyrolle 7SR5](https://agentprime.io/advisories/CVE-2026-62650.md)
  `CVE-2026-62650` · CVE record: Siemens Reyrolle 7SR5 · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Siemens Reyrolle 7SR5](https://agentprime.io/advisories/CVE-2026-62645.md)
  `CVE-2026-62645` · CVE record: Siemens Reyrolle 7SR5 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in ASUS Control Center Express Agent](https://agentprime.io/advisories/CVE-2026-19397.md)
  `CVE-2026-19397` · CVE record: ASUS Control Center Express Agent · CVSS 7.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password.](https://agentprime.io/advisories/CVE-2026-79576.md)
  `CVE-2026-79576` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [knowns before 0.30.0 Unauthenticated Management API Exposure](https://agentprime.io/advisories/CVE-2026-86543.md)
  `CVE-2026-86543` · CVE record: knowns-dev knowns · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint](https://agentprime.io/advisories/GHSA-fxc6-vp68-87pw.md)
  `GHSA-fxc6-vp68-87pw`, `CVE-2026-82758`, `EEF-CVE-2026-82758` · Hex `ash_authentication_oauth2_server`: affected `>=0.1.0, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in JetBrains GoLand](https://agentprime.io/advisories/CVE-2026-86506.md)
  `CVE-2026-86506` · CVE record: JetBrains GoLand · CVSS 5.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-86502.md)
  `CVE-2026-86502` · CVE record: JetBrains IntelliJ IDEA · CVSS 8.4 High · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86486.md)
  `CVE-2026-86486` · CVE record: JetBrains YouTrack · CVSS 3.7 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in JetBrains Hub](https://agentprime.io/advisories/CVE-2026-86480.md)
  `CVE-2026-86480` · CVE record: JetBrains Hub · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86478.md)
  `CVE-2026-86478` · CVE record: JetBrains YouTrack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property](https://agentprime.io/advisories/CVE-2026-18922.md)
  `CVE-2026-18922` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79645.md)
  `CVE-2026-79645` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 8.2 High · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-78480.md)
  `CVE-2026-78480` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80128.md)
  `CVE-2026-80128` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [light0011 cms Cookie Helper UserModel.class.php improper authentication](https://agentprime.io/advisories/CVE-2026-86306.md)
  `CVE-2026-86306` · CVE record: light0011 cms · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion](https://agentprime.io/advisories/CVE-2026-86426.md)
  `CVE-2026-86426` · CVE record: librenms librenms · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80132.md)
  `CVE-2026-80132` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 8.1 High · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [OTP Bypass in Bahçelievler Muncipality's BiHayat App](https://agentprime.io/advisories/CVE-2026-6223.md)
  `CVE-2026-6223` · CVE record: Bahçelievler Muncipality BiHayat App · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci](https://agentprime.io/advisories/CVE-2026-76578.md)
  `CVE-2026-76578` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Tenda AC9 Web Management R7WebsSecurityHandler improper authentication](https://agentprime.io/advisories/CVE-2026-86300.md)
  `CVE-2026-86300` · CVE record: Tenda AC9 · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [SourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing authentication](https://agentprime.io/advisories/CVE-2026-86293.md)
  `CVE-2026-86293` · CVE record: SourceCodester Simple Traffic Offense System · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication](https://agentprime.io/advisories/CVE-2026-86292.md)
  `CVE-2026-86292` · CVE record: SourceCodester Simple Traffic Offense System · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Incorrect access control in PrestaShop](https://agentprime.io/advisories/CVE-2026-84186.md)
  `CVE-2026-84186` · CVE record: PrestaShop PrestaShop · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation](https://agentprime.io/advisories/CVE-2026-86279.md)
  `CVE-2026-86279` · CVE record: SourceCodester Syllabus-Aligned Learning Management & Examination System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Unlimited authentication attempts in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20514.md)
  `CVE-2026-20514` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 4.4 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Unlimited authentication attempts in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20512.md)
  `CVE-2026-20512` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.7 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in NEC Corporation UNIVERGE IX-R/IX-V](https://agentprime.io/advisories/CVE-2026-16876.md)
  `CVE-2026-16876` · CVE record: NEC Corporation UNIVERGE IX-R/IX-V · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step](https://agentprime.io/advisories/CVE-2026-86219.md)
  `CVE-2026-86219` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass
- [Mstfakts College-Management-System Logout server.php session expiration](https://agentprime.io/advisories/CVE-2026-86215.md)
  `CVE-2026-86215` · CVE record: Mstfakts College-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass
- [Mstfakts College-Management-System login.php improper authentication](https://agentprime.io/advisories/CVE-2026-86214.md)
  `CVE-2026-86214` · CVE record: Mstfakts College-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass
- [OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation](https://agentprime.io/advisories/CVE-2026-86259.md)
  `CVE-2026-86259` · CVE record: THU-MAIC OpenMAIC · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF)
- [Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds](https://agentprime.io/advisories/CVE-2026-86242.md)
  `CVE-2026-86242` · CVE record: maximhq Bifrost · CVSS 8.1 High · Not analysed yet · Published 6 Sept 2026 · Tags: Code injection, Broken access control, Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA5LTA2VDExOjIwOjExLjc1OTAwMFoiLCJDVkUtMjAyNi04NjI0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA5LTA4VDE3OjE4OjE4LjMzMjAwMFoiLCJDVkUtMjAyNi02OTg1NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA5LTA4VDE3OjE4OjE4LjMzMjAwMFoiLCJDVkUtMjAyNi02OTg1NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.