# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-56592.md)
  `CVE-2026-56592` · CVE record: HCL Software HCL BigFix Service Management · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [QTS](https://agentprime.io/advisories/CVE-2024-38639.md)
  `CVE-2024-38639` · CVE record: QNAP Systems Inc. QTS · CVSS 4.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together](https://agentprime.io/advisories/CVE-2026-85350.md)
  `CVE-2026-85350` · CVE record: Unknown UpsellWP · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in Nextcloud Files Lock](https://agentprime.io/advisories/CVE-2026-82980.md)
  `CVE-2026-82980` · CVE record: Nextcloud Files Lock · CVSS 6.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID](https://agentprime.io/advisories/CVE-2026-79954.md)
  `CVE-2026-79954` · CVE record: NASA CryptoLib · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [Microsoft Fabric Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69843.md)
  `CVE-2026-69843` · CVE record: Microsoft Microsoft Fabric · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Azure AI Foundry Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85889.md)
  `CVE-2026-85889` · CVE record: Microsoft Azure AI Foundry · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Microsoft Dataverse Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-77903.md)
  `CVE-2026-77903` · CVE record: Microsoft Microsoft Dataverse · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Session id is not renewed on authentication in ash_authentication, allowing session fixation](https://agentprime.io/advisories/GHSA-v577-944g-7h3x.md)
  `GHSA-v577-944g-7h3x`, `CVE-2026-86688`, `EEF-CVE-2026-86688` · Hex `ash_authentication`: affected `>=0.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 7.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement](https://agentprime.io/advisories/GHSA-hh34-374j-pfr5.md)
  `GHSA-hh34-374j-pfr5`, `CVE-2026-76949`, `EEF-CVE-2026-76949` · Hex `ash_authentication`: affected `>=4.10.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php](https://agentprime.io/advisories/CVE-2026-54767.md)
  `CVE-2026-54767` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, Hard-coded credentials
- [WeGIA: Unauthenticated Auth Bypass + Local File Inclusion](https://agentprime.io/advisories/CVE-2026-54670.md)
  `CVE-2026-54670` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Authentication bypass
- [libmongoc SCRAM client nonce-validation bypass](https://agentprime.io/advisories/CVE-2026-93394.md)
  `CVE-2026-93394` · CVE record: MongoDB Inc. C Driver · CVSS 6.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Steeltoe: Header-forwarded client cert lacks proof of private-key possession](https://agentprime.io/advisories/GHSA-5mq7-rwhj-4fh9.md)
  `GHSA-5mq7-rwhj-4fh9`, `CVE-2026-81868` · NuGet `Steeltoe.Security.Authorization.Certificate`: affected `<4.3.0`, fixed in `4.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook](https://agentprime.io/advisories/CVE-2026-54510.md)
  `CVE-2026-54510` · CVE record: murtaza-nasir speakr · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [OpenReception: Unauthenticated WebAuthn passkey injection via \`POST /api/auth/passkeys\` leads to account takeover](https://agentprime.io/advisories/CVE-2026-54460.md)
  `CVE-2026-54460` · CVE record: open-reception appointment-booking-software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user](https://agentprime.io/advisories/CVE-2026-54618.md)
  `CVE-2026-54618` · CVE record: jimprosser obsidian-web-mcp · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, Hard-coded credentials, Open redirect
- [Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch](https://agentprime.io/advisories/CVE-2026-90997.md)
  `CVE-2026-90997` · CVE record: Keycloak Keycloak and 1 more · CVSS 7.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses](https://agentprime.io/advisories/GHSA-vrf4-mx87-p53w.md)
  `GHSA-vrf4-mx87-p53w`, `CVE-2026-86039` · npm `@libp2p/peer-store`: affected `>=8.0.0, <12.0.24`, fixed in `12.0.24` · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, CWE-345
- [AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses](https://agentprime.io/advisories/GHSA-fj9w-c36g-h5x8.md)
  `GHSA-fj9w-c36g-h5x8`, `CVE-2026-85716` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.8, <3.0.12`, fixed in `3.0.12` · CVSS 3.7 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, CWE-390
- [Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth](https://agentprime.io/advisories/GHSA-hpj9-grjp-7vc7.md)
  `GHSA-hpj9-grjp-7vc7`, `CVE-2026-73245` · Maven `io.kestra:kestra`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode](https://agentprime.io/advisories/CVE-2026-86863.md)
  `CVE-2026-86863` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, CWE-807
- [dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover](https://agentprime.io/advisories/GHSA-73j9-m294-fvv9.md)
  `GHSA-73j9-m294-fvv9`, `CVE-2026-91039`, `EEF-CVE-2026-91039` · Hex `ash_authentication`: affected `>=5.0.0-rc.10, <5.0.0-rc.14`, fixed in `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification](https://agentprime.io/advisories/GHSA-6j36-r6pr-59x4.md)
  `GHSA-6j36-r6pr-59x4`, `CVE-2026-63472` · npm `@vendure/core`: affected `<3.7.0`, fixed in `3.7.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Opencast: Session fixation in login enables account takeover via crafted link](https://agentprime.io/advisories/CVE-2026-77614.md)
  `CVE-2026-77614` · CVE record: opencast opencast · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier](https://agentprime.io/advisories/CVE-2026-92984.md)
  `CVE-2026-92984` · CVE record: hubzero hubzero-cms · CVSS 8.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication](https://agentprime.io/advisories/GHSA-wc6x-276q-jrf9.md)
  `GHSA-wc6x-276q-jrf9`, `CVE-2026-88952`, `EEF-CVE-2026-88952` · Hex `ash_authentication`: affected `>=4.14.0, <4.15.0 || >=5.0.0-rc.10, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [BMCtest exposes Ironic without authentication and TLS during the test](https://agentprime.io/advisories/CVE-2026-71568.md)
  `CVE-2026-71568` · CVE record: openshift-metal3 bmctest · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint](https://agentprime.io/advisories/CVE-2026-92972.md)
  `CVE-2026-92972` · CVE record: sgl-project sglang · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-62108.md)
  `CVE-2026-62108` · CVE record: miniOrange Headless Single Sign On · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-62101.md)
  `CVE-2026-62101` · CVE record: Chris Åkerfeldt Wendel EduAdmin Booking · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix](https://agentprime.io/advisories/GHSA-m6x4-4gvp-xwjr.md)
  `GHSA-m6x4-4gvp-xwjr`, `CVE-2026-86533`, `EEF-CVE-2026-86533` · Hex `ash_authentication` and 1 more: affected `>=4.9.1, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Sign-in token minted for one resource accepted by another in AshAuthentication](https://agentprime.io/advisories/GHSA-3pr8-f99q-86hp.md)
  `GHSA-3pr8-f99q-86hp`, `CVE-2026-80218`, `EEF-CVE-2026-80218` · Hex `ash_authentication`: affected `>=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication](https://agentprime.io/advisories/GHSA-3vcj-gxx8-3p44.md)
  `GHSA-3vcj-gxx8-3p44`, `CVE-2026-81637`, `EEF-CVE-2026-81637` · Hex `ash_authentication`: affected `>=0.6.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 2.3 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled](https://agentprime.io/advisories/CVE-2026-92920.md)
  `CVE-2026-92920` · CVE record: cjbi admin3 · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others](https://agentprime.io/advisories/CVE-2026-81441.md)
  `CVE-2026-81441` · CVE record: Dell OpenManage Server Administrator Managed Node (Patch) for Windows and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [AVideo LoginControl PGP Second Factor Authentication Bypass](https://agentprime.io/advisories/CVE-2026-92914.md)
  `CVE-2026-92914` · CVE record: WWBN AVideo · CVSS 8.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others](https://agentprime.io/advisories/CVE-2026-81475.md)
  `CVE-2026-81475` · CVE record: Dell OpenManage Server Administrator Managed Node (Patch) for Windows and 4 more · CVSS 8.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [SAML Audience Confusion Allows Cross-SP Authentication](https://agentprime.io/advisories/CVE-2026-78425.md)
  `CVE-2026-78425` · CVE record: SUSE github.com/neuvector/neuvector · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently](https://agentprime.io/advisories/CVE-2026-78428.md)
  `CVE-2026-78428` · CVE record: SUSE neuvector · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting](https://agentprime.io/advisories/CVE-2026-15688.md)
  `CVE-2026-15688` · CVE record: Mitsubishi Electric Corporation GX Works3 and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Authentication Vulnerability in NitroSense and PredatorSense Software](https://agentprime.io/advisories/CVE-2026-50608.md)
  `CVE-2026-50608` · CVE record: Acer System Monitoring · CVSS 1.2 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler](https://agentprime.io/advisories/CVE-2026-86801.md)
  `CVE-2026-86801` · CVE record: Unknown To Do List Member · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter](https://agentprime.io/advisories/CVE-2026-86710.md)
  `CVE-2026-86710` · CVE record: Unknown Login with QR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [The Pressengine <= 1.0 - Unauthenticated Authentication Bypass](https://agentprime.io/advisories/CVE-2026-86709.md)
  `CVE-2026-86709` · CVE record: Unknown The Pressengine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter](https://agentprime.io/advisories/CVE-2026-86707.md)
  `CVE-2026-86707` · CVE record: Unknown Private Feed Key · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software](https://agentprime.io/advisories/CVE-2026-50604.md)
  `CVE-2026-50604` · CVE record: Acer Agent Service · CVSS 4.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [djust has an authorization bypass on the WebSocket/SSE mount path](https://agentprime.io/advisories/GHSA-xhhm-f6hp-2qwj.md)
  `GHSA-xhhm-f6hp-2qwj`, `CVE-2026-61594`, `PYSEC-2026-4047` · PyPI `djust`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass, Broken access control
- [djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)](https://agentprime.io/advisories/GHSA-f795-p5jw-j6g2.md)
  `GHSA-f795-p5jw-j6g2`, `CVE-2026-61592`, `PYSEC-2026-4043` · PyPI `djust`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 7.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass, Broken access control
- [AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment](https://agentprime.io/advisories/CVE-2026-92583.md)
  `CVE-2026-92583` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash](https://agentprime.io/advisories/CVE-2026-92578.md)
  `CVE-2026-92578` · CVE record: WWBN AVideo · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [TCH QRing R20_B006 Unauthenticated BLE Access](https://agentprime.io/advisories/CVE-2026-89034.md)
  `CVE-2026-89034` · CVE record: TCH QRing · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard](https://agentprime.io/advisories/CVE-2026-92805.md)
  `CVE-2026-92805` · CVE record: uvdesk community-skeleton · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Docs before 5.4.1 Stale Collaboration Session After Access Revocation](https://agentprime.io/advisories/CVE-2026-92800.md)
  `CVE-2026-92800` · CVE record: suitenumerique Docs · CVSS 7.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier](https://agentprime.io/advisories/CVE-2026-92792.md)
  `CVE-2026-92792` · CVE record: OpenNHP opennhp · CVSS 8.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Cisco Identity Services Engine Certificate Reload Vulnerability](https://agentprime.io/advisories/CVE-2026-76447.md)
  `CVE-2026-76447` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [ISE 802.1x Session Hijack Vulnerability](https://agentprime.io/advisories/CVE-2026-20071.md)
  `CVE-2026-20071` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 3.8 Low · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Cisco Identity Services Engine Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-76444.md)
  `CVE-2026-76444` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Cisco Identity Services Engine Event Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76439.md)
  `CVE-2026-76439` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Cisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20343.md)
  `CVE-2026-20343` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA5LTE2VDIwOjEyOjE5Ljk0MDAwMFoiLCJDVkUtMjAyNi0yMDM0MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA5LTE4VDA4OjI5OjE1Ljg3ODAwMFoiLCJDVkUtMjAyNi00MDUzOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA5LTE4VDA4OjI5OjE1Ljg3ODAwMFoiLCJDVkUtMjAyNi00MDUzOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.