# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication](https://agentprime.io/advisories/CVE-2026-84840.md)
  `CVE-2026-84840` · CVE record: tsi-coop tsi-dpdp-cms · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication](https://agentprime.io/advisories/CVE-2026-84839.md)
  `CVE-2026-84839` · CVE record: tsi-coop tsi-dpdp-cms · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability](https://agentprime.io/advisories/CVE-2026-19117.md)
  `CVE-2026-19117` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Open edX LTI OAuth Replay Attack](https://agentprime.io/advisories/CVE-2026-53636.md)
  `CVE-2026-53636` · CVE record: openedx openedx-platform · CVSS 4.7 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Session takeover via Auth Proxy cache key collision](https://agentprime.io/advisories/CVE-2026-14199.md)
  `CVE-2026-14199` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, Broken access control, CWE-1023
- [SAML assertion replay via skipped InResponseTo validation](https://agentprime.io/advisories/CVE-2026-12704.md)
  `CVE-2026-12704` · CVE record: Grafana Grafana Enterprise · CVSS 6.8 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Session fixation in Jenkins](https://agentprime.io/advisories/CVE-2026-84652.md)
  `CVE-2026-84652` · CVE record: Jenkins Project Jenkins · CVSS 7.3 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control](https://agentprime.io/advisories/GHSA-2v6v-25fm-p4fg.md)
  `GHSA-2v6v-25fm-p4fg`, `BIT-seaweedfs-2026-72920`, `CVE-2026-72920`, `GO-2026-6351` · Go `github.com/seaweedfs/seaweedfs`: affected `<0.0.0-20260512171108-5e8f99f40a8a`, fixed in `0.0.0-20260512171108-5e8f99f40a8a` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud](https://agentprime.io/advisories/CVE-2024-7956.md)
  `CVE-2024-7956` · CVE record: Rockwell Automation DataMosaix™ Private Cloud · CVSS 7.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure](https://agentprime.io/advisories/CVE-2025-15481.md)
  `CVE-2025-15481` · CVE record: Unknown Notification Bar for WordPress · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [CVE-2026-100871: JWT audience confusion allows shop customer to authenticate as administrator](https://agentprime.io/advisories/GHSA-f6mx-qxjc-55xf.md)
  `GHSA-f6mx-qxjc-55xf`, `CVE-2026-100871`, `PKSA-b7q9-vk2h-x54x` · Packagist `sylius/sylius`: affected `>=1.11.0, <1.12.0 || >=1.12.0, <1.12.25 || >=1.13.0, <1.13.17 || >=1.14.0, <1.14.20 || >=2.0.0, <2.1.0 || >=2.1.0, <2.1.16 || >=2.2.0, <2.2.9`, fixed in `1.12.0`, `1.12.25`, `1.13.17`, `1.14.20`, `2.1.0`, `2.1.16`, `2.2.9` · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111](https://agentprime.io/advisories/CVE-2026-16647.md)
  `CVE-2026-16647` · CVE record: Drupal Disable Login Page · CVSS 4.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105](https://agentprime.io/advisories/CVE-2026-81168.md)
  `CVE-2026-81168` · CVE record: Drupal CAPTCHA Protected Page · CVSS 3.7 Low · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion](https://agentprime.io/advisories/CVE-2026-82183.md)
  `CVE-2026-82183` · CVE record: Unknown OAuth Single Sign On · CVSS 8.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action](https://agentprime.io/advisories/CVE-2026-12526.md)
  `CVE-2026-12526` · CVE record: Unknown Advanced Custom Fields: Extended · CVSS 8.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint](https://agentprime.io/advisories/CVE-2026-84485.md)
  `CVE-2026-84485` · CVE record: apitable apitable · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Pika Unauthenticated Replication Access via Internal Protobuf Port](https://agentprime.io/advisories/CVE-2026-84700.md)
  `CVE-2026-84700` · CVE record: OpenAtomFoundation pikiwidb · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands](https://agentprime.io/advisories/CVE-2026-84696.md)
  `CVE-2026-84696` · CVE record: Phison Electronics Corporation PS3111-S11 Controller Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oxford Nanopore MinKNOW](https://agentprime.io/advisories/CVE-2024-35585.md)
  `CVE-2024-35585` · CVE record: Oxford Nanopore MinKNOW · CVSS 8.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Casdoor upload-resource API resource.go missing authentication](https://agentprime.io/advisories/CVE-2026-84423.md)
  `CVE-2026-84423` · CVE record: Casdoor · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [WWBN AVideo Password Recovery Token Expiration Bypass](https://agentprime.io/advisories/CVE-2026-84480.md)
  `CVE-2026-84480` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [WWBN AVideo Authentication Bypass via User-Agent Header](https://agentprime.io/advisories/CVE-2026-84479.md)
  `CVE-2026-84479` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [WWBN AVideo Authentication Bypass via X-Real-IP Header](https://agentprime.io/advisories/CVE-2026-84476.md)
  `CVE-2026-84476` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter](https://agentprime.io/advisories/CVE-2023-54391.md)
  `CVE-2023-54391` · CVE record: Proxmox Server Solutions GmbH Proxmox Virtual Environment (VE) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used](https://agentprime.io/advisories/GHSA-r3j6-gpjw-qfjr.md)
  `GHSA-r3j6-gpjw-qfjr`, `CVE-2026-84306`, `PKSA-fwm5-nrzy-yd41` · Packagist `filament/filament`: affected `>=4.0.0, <4.12.6 || >=5.0.0, <5.7.6`, fixed in `4.12.6`, `5.7.6` · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled](https://agentprime.io/advisories/GHSA-52xp-w8hr-xv3c.md)
  `GHSA-52xp-w8hr-xv3c`, `CVE-2026-77567`, `PKSA-wst7-5d23-qy5j` · Packagist `filament/filament`: affected `>=4.0.0, <4.12.0 || >=5.0.0, <5.7.0`, fixed in `4.12.0`, `5.7.0` · CVSS 8.1 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint](https://agentprime.io/advisories/CVE-2026-73777.md)
  `CVE-2026-73777` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 8.1 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Improper Authentication Handling in AOS-CX Management Interface and API](https://agentprime.io/advisories/CVE-2026-73771.md)
  `CVE-2026-73771` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX](https://agentprime.io/advisories/CVE-2026-73764.md)
  `CVE-2026-73764` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 7.1 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon](https://agentprime.io/advisories/CVE-2026-76658.md)
  `CVE-2026-76658` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access](https://agentprime.io/advisories/CVE-2026-76657.md)
  `CVE-2026-76657` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint](https://agentprime.io/advisories/CVE-2026-73742.md)
  `CVE-2026-73742` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 4.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypasses in API allow Continued Authenticated Access in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73733.md)
  `CVE-2026-73733` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-73726.md)
  `CVE-2026-73726` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 6.8 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Unauthenticated Denial of Service Vulnerabilities in API Endpoint of HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73710.md)
  `CVE-2026-73710` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 8.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes](https://agentprime.io/advisories/CVE-2026-73706.md)
  `CVE-2026-73706` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 8.6 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-19766.md)
  `CVE-2026-19766` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Dell PowerStore 500T and others](https://agentprime.io/advisories/CVE-2026-79687.md)
  `CVE-2026-79687` · CVE record: Dell PowerStore 500T and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change](https://agentprime.io/advisories/CVE-2026-84203.md)
  `CVE-2026-84203` · CVE record: usememos memos · CVSS 8.6 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software](https://agentprime.io/advisories/CVE-2026-18771.md)
  `CVE-2026-18771` · CVE record: TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software · CVSS 7.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication](https://agentprime.io/advisories/CVE-2026-84114.md)
  `CVE-2026-84114` · CVE record: Cleo Harmony · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Unlimited authentication attempts in Schneider Electric PowerChute™ Serial Shutdown](https://agentprime.io/advisories/CVE-2026-13348.md)
  `CVE-2026-13348` · CVE record: Schneider Electric PowerChute™ Serial Shutdown · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [ControlFLASH ® – Improper Access Control](https://agentprime.io/advisories/CVE-2026-12663.md)
  `CVE-2026-12663` · CVE record: Rockwell Automation ControlFLASH ® · CVSS 7.0 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalation](https://agentprime.io/advisories/CVE-2026-16675.md)
  `CVE-2026-16675` · CVE record: Rockwell Automation FactoryTalk® Activation Manager · CVSS 8.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Dell PowerStore 500T and others](https://agentprime.io/advisories/CVE-2026-58575.md)
  `CVE-2026-58575` · CVE record: Dell PowerStore 500T and 4 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding](https://agentprime.io/advisories/CVE-2026-77194.md)
  `CVE-2026-77194` · CVE record: wpinsider-1 Simple Membership · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token](https://agentprime.io/advisories/CVE-2026-19806.md)
  `CVE-2026-19806` · CVE record: devitemsllc Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [cu silicon edit Endpoint views.py create_app missing authentication](https://agentprime.io/advisories/CVE-2026-82919.md)
  `CVE-2026-82919` · CVE record: cu silicon · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Wallos: OIDC account takeover via email-based account linking without \`email_verified\` check](https://agentprime.io/advisories/CVE-2026-61641.md)
  `CVE-2026-61641` · CVE record: ellite Wallos · CVSS 8.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Wallos: Unauthenticated database replacement via import endpoint on fresh install](https://agentprime.io/advisories/CVE-2026-54600.md)
  `CVE-2026-54600` · CVE record: ellite Wallos · CVSS 8.2 High · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability](https://agentprime.io/advisories/CVE-2026-82228.md)
  `CVE-2026-82228` · CVE record: SiteGround SiteGround Security · CVSS 8.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-82225.md)
  `CVE-2026-82225` · CVE record: Metagauss RegistrationMagic · CVSS 7.4 High · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [QuantumNous new-api Revoked API Token token session expiration](https://agentprime.io/advisories/CVE-2026-82909.md)
  `CVE-2026-82909` · CVE record: QuantumNous new-api · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Missing Authentication for Critical Function in wallos](https://agentprime.io/advisories/CVE-2026-54598.md)
  `CVE-2026-54598` · CVE record: ellite Wallos · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication](https://agentprime.io/advisories/CVE-2026-82906.md)
  `CVE-2026-82906` · CVE record: sdcb chats · CVSS 6.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Ebyte NA111-M Weak Authentication](https://agentprime.io/advisories/CVE-2026-73819.md)
  `CVE-2026-73819` · CVE record: Ebyte Ebyte NA111-M Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process](https://agentprime.io/advisories/CVE-2026-75133.md)
  `CVE-2026-75133` · CVE record: Fahad Mahmood Keep Backup Daily · CVSS 8.7 High · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE](https://agentprime.io/advisories/CVE-2026-66047.md)
  `CVE-2026-66047` · CVE record: Proper Fraction ProfilePress · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Tenda AC18 Telnet telnet missing authentication](https://agentprime.io/advisories/CVE-2026-82695.md)
  `CVE-2026-82695` · CVE record: Tenda AC18 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication](https://agentprime.io/advisories/CVE-2026-82694.md)
  `CVE-2026-82694` · CVE record: Tenda AC1206 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA4LTMxVDEyOjMwOjEwLjY1MjAwMFoiLCJDVkUtMjAyNi04MjY5NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA5LTAyVDIyOjAxOjI1LjAwMDAwMFoiLCJHSFNBLTdtZ2MtYzdwcS0zcnIzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA5LTAyVDIyOjAxOjI1LjAwMDAwMFoiLCJHSFNBLTdtZ2MtYzdwcS0zcnIzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.