# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint](https://agentprime.io/advisories/CVE-2026-91996.md)
  `CVE-2026-91996` · CVE record: dromara lamp-cloud · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Session Fixation](https://agentprime.io/advisories/CVE-2026-1758.md)
  `CVE-2026-1758` · CVE record: Secomea GateManager · CVSS 8.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [stamparm maltrail Blacklist Endpoint httpd.py \_blacklist missing authentication](https://agentprime.io/advisories/CVE-2026-91002.md)
  `CVE-2026-91002` · CVE record: stamparm maltrail · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Insufficient session expiration in bizwell xClick](https://agentprime.io/advisories/CVE-2026-88262.md)
  `CVE-2026-88262` · CVE record: bizwell xClick · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php \_\_construct improper authentication](https://agentprime.io/advisories/CVE-2026-90840.md)
  `CVE-2026-90840` · CVE record: PHPGurukul Blood Donor Management System · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segm…](https://agentprime.io/advisories/CVE-2026-73449.md)
  `CVE-2026-73449` · CVE record: Arista Networks EOS · CVSS 5.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [goproxy through 15.3 Authentication Bypass via CONNECT](https://agentprime.io/advisories/CVE-2026-91143.md)
  `CVE-2026-91143` · CVE record: snail007 goproxy · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control](https://agentprime.io/advisories/CVE-2026-19273.md)
  `CVE-2026-19273` · CVE record: IBM Sterling B2B Integrator and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII](https://agentprime.io/advisories/CVE-2026-90896.md)
  `CVE-2026-90896` · CVE record: MarcosCamara01 Ecommerce Template · CVSS 8.2 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Insufficiently random values in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84606.md)
  `CVE-2026-84606` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS, Information disclosure
- [Authentication bypass by spoofing in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65399.md)
  `CVE-2026-65399` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 4.4 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-43674.md)
  `CVE-2026-43674` · CVE record: Apple iOS and iPadOS · CVSS 4.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-20683.md)
  `CVE-2026-20683` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-84623.md)
  `CVE-2026-84623` · CVE record: Apple iOS and iPadOS · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in Apple macOS](https://agentprime.io/advisories/CVE-2026-65375.md)
  `CVE-2026-65375` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-86890.md)
  `CVE-2026-86890` · CVE record: Apple iOS and iPadOS · CVSS 4.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Langflow is vulnerable to authentication bypass and insufficient session expiration](https://agentprime.io/advisories/CVE-2026-12763.md)
  `CVE-2026-12763` · CVE record: IBM Langflow OSS · CVSS 4.2 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Langflow is affected by improper authentication due to missing password verification in the password reset endpoint](https://agentprime.io/advisories/CVE-2026-17628.md)
  `CVE-2026-17628` · CVE record: IBM Langflow OSS · CVSS 5.4 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.](https://agentprime.io/advisories/CVE-2026-18065.md)
  `CVE-2026-18065` · CVE record: IBM i · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade](https://agentprime.io/advisories/GHSA-rrxg-g2pf-6hh4.md)
  `GHSA-rrxg-g2pf-6hh4`, `CVE-2026-59178`, `PYSEC-2026-4049` · PyPI `esphome-device-builder`: affected `<1.0.12`, fixed in `1.0.12` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse](https://agentprime.io/advisories/CVE-2026-90944.md)
  `CVE-2026-90944` · CVE record: krayin laravel-crm · CVSS 8.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Eclipse Foundation Eclipse Data Plane Core](https://agentprime.io/advisories/CVE-2026-88819.md)
  `CVE-2026-88819` · CVE record: Eclipse Foundation Eclipse Data Plane Core · CVSS 6.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass, CWE-345
- [MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials](https://agentprime.io/advisories/CVE-2026-90961.md)
  `CVE-2026-90961` · CVE record: MISP MISP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass, CWE-20
- [LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket](https://agentprime.io/advisories/CVE-2026-90938.md)
  `CVE-2026-90938` · CVE record: langbot-app LangBot · CVSS 8.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Improper Claim Validation in PingAM OIDC Provider](https://agentprime.io/advisories/CVE-2026-21391.md)
  `CVE-2026-21391` · CVE record: Ping Identity PingAM · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Apache Syncope: JWT subject spoofing](https://agentprime.io/advisories/CVE-2026-87785.md)
  `CVE-2026-87785` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Bifrost unauthenticated remote code execution via MCP stdio client registration](https://agentprime.io/advisories/CVE-2026-90898.md)
  `CVE-2026-90898` · CVE record: maximhq Bifrost · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control, Authentication bypass
- [Missing authentication in Contec Co., Ltd. CPSL-08P1EN](https://agentprime.io/advisories/CVE-2026-82787.md)
  `CVE-2026-82787` · CVE record: Contec Co., Ltd. CPSL-08P1EN · CVSS 8.7 High · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\*](https://agentprime.io/advisories/CVE-2026-82784.md)
  `CVE-2026-82784` · CVE record: Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\* · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation](https://agentprime.io/advisories/CVE-2026-90623.md)
  `CVE-2026-90623` · CVE record: andreashappe cochise · CVSS 6.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication](https://agentprime.io/advisories/CVE-2026-90620.md)
  `CVE-2026-90620` · CVE record: 0x4m4 HexStrike AI · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in N-able Mail Assure](https://agentprime.io/advisories/CVE-2025-68624.md)
  `CVE-2025-68624` · CVE record: N-able Mail Assure · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [getzep graphiti REST API main.py improper authentication](https://agentprime.io/advisories/CVE-2026-90601.md)
  `CVE-2026-90601` · CVE record: getzep graphiti · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Authentication bypass
- [cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py \_authorize_http_key missing authentication](https://agentprime.io/advisories/CVE-2026-90579.md)
  `CVE-2026-90579` · CVE record: cheshire-cat-ai Cheshire Cat AI · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Authentication bypass
- [jaychouchannel Tourism-Management-System Update Endpoint missing authentication](https://agentprime.io/advisories/CVE-2026-90524.md)
  `CVE-2026-90524` · CVE record: jaychouchannel Tourism-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Authentication bypass
- [simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication](https://agentprime.io/advisories/CVE-2026-90513.md)
  `CVE-2026-90513` · CVE record: simalexan api-lambda-send-email-ses · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Authentication bypass
- [vvbbnn00 WARP-Clash-API authorized missing authentication](https://agentprime.io/advisories/CVE-2026-90504.md)
  `CVE-2026-90504` · CVE record: vvbbnn00 WARP-Clash-API · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Authentication bypass
- [Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion](https://agentprime.io/advisories/CVE-2026-89080.md)
  `CVE-2026-89080` · CVE record: Unknown Really Simple Security · CVSS 7.5 High · Not analysed yet · Published 13 Sept 2026 · Tags: Authentication bypass
- [WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php](https://agentprime.io/advisories/CVE-2026-90543.md)
  `CVE-2026-90543` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 12 Sept 2026 · Tags: Authentication bypass
- [MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass](https://agentprime.io/advisories/CVE-2026-90474.md)
  `CVE-2026-90474` · CVE record: samanhappy mcphub · CVSS 7.6 High · Not analysed yet · Published 12 Sept 2026 · Tags: Authentication bypass
- [Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse](https://agentprime.io/advisories/CVE-2026-75800.md)
  `CVE-2026-75800` · CVE record: Unknown Frontegg SAML SSO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Authentication bypass
- [ZITADEL: Auto-linking by email: IdP-side email verification is not checked](https://agentprime.io/advisories/GHSA-992q-9gwp-7r79.md)
  `GHSA-992q-9gwp-7r79`, `CVE-2026-56666`, `GO-2026-6470` · Go `github.com/zitadel/zitadel`: affected `<4.15.3`, fixed in `4.15.3` · CVSS 4.8 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft](https://agentprime.io/advisories/GHSA-rqx4-3f6q-3x2v.md)
  `GHSA-rqx4-3f6q-3x2v`, `CVE-2026-59148` · npm `@mockoon/cli` and 1 more: affected `<9.7.0`, fixed in `9.7.0` · CVSS 8.8 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), Broken access control, CWE-942
- [Missing Authentication for Critical Function in Malcolm](https://agentprime.io/advisories/CVE-2026-90449.md)
  `CVE-2026-90449` · CVE record: CISA Malcolm · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypass by Spoofing in Malcolm](https://agentprime.io/advisories/CVE-2026-90447.md)
  `CVE-2026-90447` · CVE record: CISA Malcolm · CVSS 7.1 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover](https://agentprime.io/advisories/GHSA-h8m9-jgf8-vwvp.md)
  `GHSA-h8m9-jgf8-vwvp`, `CVE-2026-100169`, `CVE-2026-59151`, `PYSEC-2026-3725` · PyPI `prowler-cloud`: affected `<5.30.3`, fixed in `5.30.3` · CVSS 7.6 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [ZITADEL: Missing Token Expiration (\`exp\`) Validation in JWT IdP Provider](https://agentprime.io/advisories/GHSA-v77h-2w3m-94hx.md)
  `GHSA-v77h-2w3m-94hx`, `CVE-2026-56665`, `GO-2026-6469` · Go `github.com/zitadel/zitadel`: affected `<3.4.12 || >=4.0.0-rc.1, <4.15.2`, fixed in `3.4.12`, `4.15.2` · CVSS 4.2 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state](https://agentprime.io/advisories/CVE-2026-50025.md)
  `CVE-2026-50025` · CVE record: t-mart mousehole · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure, Authentication bypass, Cross-site request forgery (CSRF), Broken access control
- [MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)](https://agentprime.io/advisories/GHSA-rqfv-2mw9-78g2.md)
  `GHSA-rqfv-2mw9-78g2`, `CVE-2026-59971`, `PYSEC-2026-4109` · PyPI `mysql-mcp-server`: affected `<0.4.2`, fixed in `0.4.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, CWE-346
- [GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw](https://agentprime.io/advisories/CVE-2026-53952.md)
  `CVE-2026-53952` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control, Authentication bypass, CWE-489
- [Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation](https://agentprime.io/advisories/CVE-2026-54047.md)
  `CVE-2026-54047` · CVE record: LaciSynchroni server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, CWE-349, CWE-602
- [MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint](https://agentprime.io/advisories/CVE-2026-89263.md)
  `CVE-2026-89263` · CVE record: moxi624 MoguBlog · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints](https://agentprime.io/advisories/CVE-2026-89261.md)
  `CVE-2026-89261` · CVE record: moxi624 MoguBlog · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project wit…](https://agentprime.io/advisories/CVE-2026-3869.md)
  `CVE-2026-3869` · CVE record: Schneider Electric Modicon M580 and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Privilege Escalation in Progress Chef Automate](https://agentprime.io/advisories/CVE-2026-80462.md)
  `CVE-2026-80462` · CVE record: Progress Software Chef Automate · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [WWBN AVideo Unauthenticated File Read via getRecordedFile.php](https://agentprime.io/advisories/CVE-2026-89250.md)
  `CVE-2026-89250` · CVE record: WWBN AVideo · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Howyar｜WeenyGenius - Missing Authentication](https://agentprime.io/advisories/CVE-2026-89176.md)
  `CVE-2026-89176` · CVE record: Howyar WeenyGenius · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection](https://agentprime.io/advisories/CVE-2026-89174.md)
  `CVE-2026-89174` · CVE record: Kingdom Communication Associated EH3040 and 3 more · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure](https://agentprime.io/advisories/CVE-2026-86781.md)
  `CVE-2026-86781` · CVE record: Unknown SSL Zen — SSL Certificate Installer & HTTPS Redirects · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover](https://agentprime.io/advisories/CVE-2026-14563.md)
  `CVE-2026-14563` · CVE record: Unknown advanced-customized-prompts · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA5LTExVDA2OjAwOjA2Ljg5ODAwMFoiLCJDVkUtMjAyNi0xNDU2MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA5LTE1VDE0OjA0OjI1LjI0MTAwMFoiLCJDVkUtMjAyNi05MjA4MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA5LTE1VDE0OjA0OjI1LjI0MTAwMFoiLCJDVkUtMjAyNi05MjA4MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.