# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [mall4j through 4.0 Insufficient Session Expiration via Token Refresh](https://agentprime.io/advisories/CVE-2026-102367.md)
  `CVE-2026-102367` · CVE record: gz-yami mall4j · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API](https://agentprime.io/advisories/CVE-2026-102364.md)
  `CVE-2026-102364` · CVE record: gz-yami mall4j · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number](https://agentprime.io/advisories/CVE-2026-102363.md)
  `CVE-2026-102363` · CVE record: gz-yami mall4j · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [mall4j through 4.0 Missing Authentication in Product Review Deletion](https://agentprime.io/advisories/CVE-2026-102362.md)
  `CVE-2026-102362` · CVE record: gz-yami mall4j · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [mall4j through 4.0 Missing Authentication in Password Update Endpoint](https://agentprime.io/advisories/CVE-2026-102361.md)
  `CVE-2026-102361` · CVE record: gz-yami mall4j · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection](https://agentprime.io/advisories/CVE-2026-102334.md)
  `CVE-2026-102334` · CVE record: NginxProxyManager nginx-proxy-manager · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [LiteLLM Weak JWT Authentication via Email-Based User Lookup](https://agentprime.io/advisories/CVE-2026-93355.md)
  `CVE-2026-93355` · CVE record: BerriAI litellm · CVSS 7.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Bluehood: Missing authentication on Bluehood API routes when web auth is enabled](https://agentprime.io/advisories/CVE-2026-49994.md)
  `CVE-2026-49994` · CVE record: dannymcc bluehood · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass, Broken access control
- [Session Not Revoked Server-Side on Logout in Rancher](https://agentprime.io/advisories/CVE-2026-88805.md)
  `CVE-2026-88805` · CVE record: SUSE Rancher · CVSS 8.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service](https://agentprime.io/advisories/CVE-2026-91154.md)
  `CVE-2026-91154` · CVE record: MarcosCamara01 Ecommerce Template · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Netcore NR289-GE boa_temp process_request missing authentication](https://agentprime.io/advisories/CVE-2026-101077.md)
  `CVE-2026-101077` · CVE record: Netcore NR289-GE · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver](https://agentprime.io/advisories/CVE-2026-93539.md)
  `CVE-2026-93539` · CVE record: SUSE Rancher · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet](https://agentprime.io/advisories/CVE-2026-93538.md)
  `CVE-2026-93538` · CVE record: SUSE Rancher · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass, Broken access control
- [Netcore NR289-GE CGI Dispatcher boa improper authentication](https://agentprime.io/advisories/CVE-2026-101073.md)
  `CVE-2026-101073` · CVE record: Netcore NR289-GE · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Improper Authentication in Kaon AR2140X](https://agentprime.io/advisories/CVE-2026-52749.md)
  `CVE-2026-52749` · CVE record: Kaon AR2140 · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Missing authentication for backup functionality in Kaon AR2140X](https://agentprime.io/advisories/CVE-2026-52748.md)
  `CVE-2026-52748` · CVE record: Kaon AR2140 · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Missing Authentication in mH-DEVELOPER](https://agentprime.io/advisories/CVE-2026-82930.md)
  `CVE-2026-82930` · CVE record: F&F Filipowski mH-DEVELOPER · CVSS 6.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Apache Roller: WSSE digest authentication headers can be replayed](https://agentprime.io/advisories/CVE-2026-82379.md)
  `CVE-2026-82379` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Apache Roller: Anonymous setup action allows frontpage configuration tampering](https://agentprime.io/advisories/CVE-2026-82383.md)
  `CVE-2026-82383` · CVE record: Apache Software Foundation Apache Roller · CVSS 8.2 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords](https://agentprime.io/advisories/CVE-2026-88828.md)
  `CVE-2026-88828` · CVE record: Unknown Blacklist Manager · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication](https://agentprime.io/advisories/CVE-2026-101004.md)
  `CVE-2026-101004` · CVE record: notionnext-org NotionNext · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [ООО НПО Ритм GEOritm REST API obj-groups missing authentication](https://agentprime.io/advisories/CVE-2026-100903.md)
  `CVE-2026-100903` · CVE record: ООО НПО Ритм GEOritm · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass
- [Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication](https://agentprime.io/advisories/CVE-2026-100886.md)
  `CVE-2026-100886` · CVE record: Seetong T8108 and 3 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Obot Quickstart Docker Deployment Unauthenticated Admin Access](https://agentprime.io/advisories/CVE-2026-101065.md)
  `CVE-2026-101065` · CVE record: obot-platform obot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication](https://agentprime.io/advisories/CVE-2026-100876.md)
  `CVE-2026-100876` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Heym before 0.0.53 Authentication Bypass via Telegram Webhook](https://agentprime.io/advisories/CVE-2026-101050.md)
  `CVE-2026-101050` · CVE record: heymrun heym · CVSS 8.3 High · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Heym before 0.0.53 Slack Webhook Signature Verification Bypass](https://agentprime.io/advisories/CVE-2026-101049.md)
  `CVE-2026-101049` · CVE record: heymrun heym · CVSS 8.3 High · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity](https://agentprime.io/advisories/CVE-2026-101042.md)
  `CVE-2026-101042` · CVE record: parse-community parse-server · CVSS 7.4 High · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Client accepts unsolicited RawPublicKey server certificate type](https://agentprime.io/advisories/CVE-2026-89136.md)
  `CVE-2026-89136` · CVE record: wolfSSL wolfSSL · CVSS 8.3 High · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Client session cache reference poisoning allows resumption with wrong server](https://agentprime.io/advisories/CVE-2026-94419.md)
  `CVE-2026-94419` · CVE record: wolfSSL wolfSSL · CVSS 2.3 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [coollabsio Coolify GitHub App Setup redirect missing authentication](https://agentprime.io/advisories/CVE-2026-100746.md)
  `CVE-2026-100746` · CVE record: coollabsio Coolify · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter](https://agentprime.io/advisories/CVE-2026-85984.md)
  `CVE-2026-85984` · CVE record: cyberlord92 miniOrange OTP Login, Verification and SMS Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)](https://agentprime.io/advisories/GHSA-mgrx-3hqw-485h.md)
  `GHSA-mgrx-3hqw-485h` · npm `flowise`: affected `<=3.1.4`, no fixed version yet · CVSS 7.7 High · Withdrawn · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [froxlor before 2.3.12 Authentication Bypass via Session Persistence](https://agentprime.io/advisories/CVE-2026-100711.md)
  `CVE-2026-100711` · CVE record: froxlor froxlor · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Froxlor before 2.3.11 2FA Bypass via Namespace Confusion](https://agentprime.io/advisories/CVE-2026-100709.md)
  `CVE-2026-100709` · CVE record: froxlor froxlor · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC](https://agentprime.io/advisories/CVE-2026-100684.md)
  `CVE-2026-100684` · CVE record: budibase server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting](https://agentprime.io/advisories/CVE-2026-100678.md)
  `CVE-2026-100678` · CVE record: stoatchat stoatchat · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure](https://agentprime.io/advisories/CVE-2026-100672.md)
  `CVE-2026-100672` · CVE record: getgrav grav-plugin-comments · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass](https://agentprime.io/advisories/CVE-2026-100667.md)
  `CVE-2026-100667` · CVE record: getgrav grav · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Capgo.app before 12.264.5 Upload Expiry Bypass via build upload](https://agentprime.io/advisories/CVE-2026-100624.md)
  `CVE-2026-100624` · CVE record: Cap-go capgo.app · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Flowise through 3.1.4 Authentication Bypass via Email-Only SSO](https://agentprime.io/advisories/CVE-2026-100607.md)
  `CVE-2026-100607` · CVE record: FlowiseAI Flowise · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Flowise through 3.1.4 Authentication Bypass via SSO Email Match](https://agentprime.io/advisories/CVE-2026-100606.md)
  `CVE-2026-100606` · CVE record: FlowiseAI Flowise · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass](https://agentprime.io/advisories/CVE-2026-100554.md)
  `CVE-2026-100554` · CVE record: OpenClaw OpenClaw · CVSS 2.3 Low · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Flame through 2.4.0 Admin Token Insufficient Session Expiration](https://agentprime.io/advisories/CVE-2026-100502.md)
  `CVE-2026-100502` · CVE record: pawelmalak flame · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Flame through 2.4.0 Brute-Force Attack via Login Endpoint](https://agentprime.io/advisories/CVE-2026-100501.md)
  `CVE-2026-100501` · CVE record: pawelmalak flame · CVSS 8.3 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests](https://agentprime.io/advisories/GHSA-q986-4x7x-gx39.md)
  `GHSA-q986-4x7x-gx39`, `CVE-2026-57443`, `PYSEC-2026-4163` · PyPI `scbe-aethermoore`: affected `>=4.0.2, <4.2.1`, fixed in `4.2.1` · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6](https://agentprime.io/advisories/CVE-2026-100390.md)
  `CVE-2026-100390` · CVE record: tobychui zoraxy · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools](https://agentprime.io/advisories/GHSA-9gfj-28hw-jchp.md)
  `GHSA-9gfj-28hw-jchp`, `CVE-2026-86439` · npm `knowns`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, Authentication bypass, Broken access control
- [Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS](https://agentprime.io/advisories/CVE-2026-5267.md)
  `CVE-2026-5267` · CVE record: Ciena Navigator NCS · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force](https://agentprime.io/advisories/CVE-2026-49470.md)
  `CVE-2026-49470` · CVE record: glpi-project glpi · CVSS 7.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Zammad: Missing rate limiting allows password brute-forcing during two-factor login](https://agentprime.io/advisories/CVE-2026-84461.md)
  `CVE-2026-84461` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Authentication bypass, CWE-799
- [Zammad: S/MIME signature verification allows forged sender impersonation](https://agentprime.io/advisories/CVE-2026-84465.md)
  `CVE-2026-84465` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Zammad: Account takeover via unverified email matching during SSO auto-link](https://agentprime.io/advisories/CVE-2026-84458.md)
  `CVE-2026-84458` · CVE record: zammad zammad · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [X-SpringBoot through 6.0 Authentication Bypass via Login Code](https://agentprime.io/advisories/CVE-2026-97063.md)
  `CVE-2026-97063` · CVE record: yzcheng90 X-SpringBoot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint](https://agentprime.io/advisories/CVE-2026-100192.md)
  `CVE-2026-100192` · CVE record: yzcheng90 X-SpringBoot · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Zammad: Denial of Service via OTRS Import Controller](https://agentprime.io/advisories/CVE-2026-56725.md)
  `CVE-2026-56725` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass, Denial of service
- [Zammad: PGP signature spoofing via unvalidated verification return](https://agentprime.io/advisories/CVE-2026-56727.md)
  `CVE-2026-56727` · CVE record: zammad zammad · CVSS 7.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-391
- [zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication](https://agentprime.io/advisories/CVE-2026-97879.md)
  `CVE-2026-97879` · CVE record: zhistaredu StarTraining · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [zhistaredu StarTraining Druid Console index.html anonymous missing authentication](https://agentprime.io/advisories/CVE-2026-97878.md)
  `CVE-2026-97878` · CVE record: zhistaredu StarTraining · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp](https://agentprime.io/advisories/CVE-2026-67242.md)
  `CVE-2026-67242` · CVE record: rabbitmq rabbitmq-server · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA5LTI1VDE2OjE2OjE0LjU1ODAwMFoiLCJDVkUtMjAyNi02NzI0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA5LTI5VDAwOjMwOjE1LjUwNDAwMFoiLCJDVkUtMjAyNi0xMDEyODAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA5LTI5VDAwOjMwOjE1LjUwNDAwMFoiLCJDVkUtMjAyNi0xMDEyODAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.