# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [\[mcp-atlassian\] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token](https://agentprime.io/advisories/GHSA-wrhw-j3f9-8vc6.md)
  `GHSA-wrhw-j3f9-8vc6`, `CVE-2026-77244`, `PYSEC-2026-4103` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass, Broken access control
- [MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport](https://agentprime.io/advisories/GHSA-cc5h-2pwp-pvcc.md)
  `GHSA-cc5h-2pwp-pvcc`, `CVE-2026-77248`, `PYSEC-2026-4089` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 8.6 High · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Authentication bypass
- [Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header](https://agentprime.io/advisories/GHSA-fq95-v8xc-jm3v.md)
  `GHSA-fq95-v8xc-jm3v`, `CVE-2026-62987`, `GO-2026-6566` · Go `github.com/fabiolb/fabio`: affected `>=1.6.6, <1.7.2`, fixed in `1.7.2` · CVSS 5.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass, CWE-348
- [MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials](https://agentprime.io/advisories/CVE-2026-77254.md)
  `CVE-2026-77254` · CVE record: sooperset mcp-atlassian · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header](https://agentprime.io/advisories/GHSA-32gc-64m7-hj7v.md)
  `GHSA-32gc-64m7-hj7v`, `CVE-2026-56682` · npm `9router`: affected `<0.5.8`, fixed in `0.5.8` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass, CWE-807
- [Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key](https://agentprime.io/advisories/CVE-2026-94455.md)
  `CVE-2026-94455` · CVE record: GitroomHQ postiz-app · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass, Denial of service, CWE-345
- [Refresh tokens accepted as private repository credentials at the CDN](https://agentprime.io/advisories/CVE-2026-86698.md)
  `CVE-2026-86698` · CVE record: hexpm hexpm · CVSS 2.3 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Sync-in Server has a complete 2FA Bypass via \`POST /api/auth/token\`](https://agentprime.io/advisories/GHSA-92cr-jxw4-5wjg.md)
  `GHSA-92cr-jxw4-5wjg`, `CVE-2026-58269` · npm `@sync-in/server`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [@sync-in/server vulnerable to TOTP Brute-Force via \`POST /api/app/sync/register\`](https://agentprime.io/advisories/GHSA-274f-6w77-8qm9.md)
  `GHSA-274f-6w77-8qm9`, `CVE-2026-58271` · npm `@sync-in/server`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 6.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in NVIDIA Infrastructure Controller](https://agentprime.io/advisories/CVE-2026-65114.md)
  `CVE-2026-65114` · CVE record: NVIDIA Infrastructure Controller · CVSS 8.3 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Improper authentication in NVIDIA Infrastructure Controller](https://agentprime.io/advisories/CVE-2026-65121.md)
  `CVE-2026-65121` · CVE record: NVIDIA Infrastructure Controller · CVSS 8.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass vulnerability](https://agentprime.io/advisories/CVE-2026-75791.md)
  `CVE-2026-75791` · CVE record: Zohocorp ManageEngine ADSelfService Plus · CVSS 8.6 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication](https://agentprime.io/advisories/CVE-2026-95271.md)
  `CVE-2026-95271` · CVE record: dgtlmoon changedetection.io · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed](https://agentprime.io/advisories/GHSA-p9fv-9w58-95x2.md)
  `GHSA-p9fv-9w58-95x2`, `CVE-2026-87119`, `EEF-CVE-2026-87119` · Hex `mpp`: affected `>=0.14.0, <0.16.2`, fixed in `0.16.2` · CVSS 8.2 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-93928.md)
  `CVE-2026-93928` · CVE record: Magepeople inc. Taxi Booking Manager for WooCommerce · CVSS 7.3 High · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Gigatech PDV5701 WebSocket Service index.html missing authentication](https://agentprime.io/advisories/CVE-2026-94493.md)
  `CVE-2026-94493` · CVE record: Gigatech PDV5701 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [webpy web.py 0.76 is vulnerable to Insufficient Session Expiration.](https://agentprime.io/advisories/CVE-2026-79313.md)
  `CVE-2026-79313` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [webpy web.py 0.76 is vulnerable to Session Fixation.](https://agentprime.io/advisories/CVE-2026-79312.md)
  `CVE-2026-79312` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in \_protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without v…](https://agentprime.io/advisories/CVE-2026-37604.md)
  `CVE-2026-37604` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0.](https://agentprime.io/advisories/CVE-2026-37603.md)
  `CVE-2026-37603` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [nginx ignition has TOTP Reuse During Validity Window](https://agentprime.io/advisories/GHSA-hf33-q6cf-c66f.md)
  `GHSA-hf33-q6cf-c66f`, `CVE-2026-61630`, `GO-2026-6537` · Go `github.com/lucasdillmann/nginx-ignition`: affected `>=0.0.0-20260217145239-1cbfae0296f1, <0.0.0-20260328015550-8d35e1eb5dd6`, fixed in `0.0.0-20260328015550-8d35e1eb5dd6` · CVSS 4.2 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [DesktopSMS 1.11.0 Unauthorized Access via Local Service](https://agentprime.io/advisories/CVE-2026-94540.md)
  `CVE-2026-94540` · CVE record: MrPear DesktopSMS · CVSS 7.4 High · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)](https://agentprime.io/advisories/CVE-2026-55210.md)
  `CVE-2026-55210` · CVE record: laurent22 joplin · CVSS 7.4 High · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint](https://agentprime.io/advisories/CVE-2026-46649.md)
  `CVE-2026-46649` · CVE record: laurent22 joplin · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [MaxKB: Expired application API keys remain usable on \`/chat/api/mcp\`](https://agentprime.io/advisories/CVE-2026-77519.md)
  `CVE-2026-77519` · CVE record: 1Panel-dev MaxKB · CVSS 5.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets](https://agentprime.io/advisories/CVE-2026-63329.md)
  `CVE-2026-63329` · CVE record: warp-tech warpgate · CVSS 4.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass, CWE-116
- [Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState](https://agentprime.io/advisories/GHSA-phg3-3g28-wq9v.md)
  `GHSA-phg3-3g28-wq9v`, `CVE-2026-61687`, `GO-2026-6535` · Go `github.com/hatchet-dev/hatchet`: affected `<0.91.1`, fixed in `0.91.1` · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-1275
- [Mailu: Authentication bypass in header-based proxy authentication via spoofable \`X-Forwarded-By\` trust](https://agentprime.io/advisories/CVE-2026-85751.md)
  `CVE-2026-85751` · CVE record: Mailu Mailu and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass, CWE-807
- [Apache Airflow: the Core API logout endpoint revokes only a session token presented as the \_token cookie. When a client logs out presenting its credential as an Authorization bearer header instead,...](https://agentprime.io/advisories/PYSEC-2026-3990.md)
  `PYSEC-2026-3990`, `BIT-airflow-2026-86473`, `CVE-2026-86473` · PyPI `apache-airflow`: affected `>=3.0.0, <3.3.2`, fixed in `3.3.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [When a request to the Airflow core API carries both a session cookie and an explicit \`Authorization: Bearer\` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverti...](https://agentprime.io/advisories/PYSEC-2026-3989.md)
  `PYSEC-2026-3989`, `BIT-airflow-2026-82355`, `CVE-2026-82355` · PyPI `apache-airflow`: affected `<=3.3.0`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [Omega Solution HRM OS Role Permission API permission missing authentication](https://agentprime.io/advisories/CVE-2026-94151.md)
  `CVE-2026-94151` · CVE record: Omega Solution HRM OS · CVSS 6.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.](https://agentprime.io/advisories/CVE-2026-88410.md)
  `CVE-2026-88410` · CVE record · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [A session invalidation flaw exists in x-ui 0.3.2.](https://agentprime.io/advisories/CVE-2026-79317.md)
  `CVE-2026-79317` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL](https://agentprime.io/advisories/CVE-2026-92254.md)
  `CVE-2026-92254` · CVE record: Watchdog Anti-Virus · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Authentication bypass, CWE-20
- [mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack](https://agentprime.io/advisories/CVE-2026-94112.md)
  `CVE-2026-94112` · CVE record: mayswind ezBookkeeping · CVSS 7.6 High · Not analysed yet · Published 20 Sept 2026 · Tags: Authentication bypass
- [NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication](https://agentprime.io/advisories/CVE-2026-93964.md)
  `CVE-2026-93964` · CVE record: NginxProxyManager nginx-proxy-manager · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Authentication bypass
- [Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication](https://agentprime.io/advisories/CVE-2026-93960.md)
  `CVE-2026-93960` · CVE record: Pixelfed · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Authentication bypass
- [OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret](https://agentprime.io/advisories/CVE-2026-93984.md)
  `CVE-2026-93984` · CVE record: Openpanel-dev openpanel · CVSS 6.9 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Authentication bypass
- [Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register](https://agentprime.io/advisories/CVE-2026-89093.md)
  `CVE-2026-89093` · CVE record: wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Authentication bypass
- [CordysCRM: Unauthenticated arbitrary file disclosure via \`/attachment/preview/{id}\` and \`/pic/preview/{id}\`](https://agentprime.io/advisories/CVE-2026-76902.md)
  `CVE-2026-76902` · CVE record: 1Panel-dev CordysCRM · CVSS 5.0 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, Broken access control
- [CordysCRM SSE Notification Stream Hijack via \`/sse/subscribe\`](https://agentprime.io/advisories/CVE-2026-63647.md)
  `CVE-2026-63647` · CVE record: 1Panel-dev CordysCRM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, Broken access control
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84078.md)
  `CVE-2026-84078` · CVE record: IBM Guardium Data Protection · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84075.md)
  `CVE-2026-84075` · CVE record: IBM Guardium Data Protection · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-82967.md)
  `CVE-2026-82967` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [IBM Sterling File Gateway is Vulnerable to Authentication Bypass](https://agentprime.io/advisories/CVE-2026-75878.md)
  `CVE-2026-75878` · CVE record: IBM Sterling File Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint](https://agentprime.io/advisories/CVE-2026-93839.md)
  `CVE-2026-93839` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-11539.md)
  `CVE-2026-11539` · CVE record: IBM WebSphere Application Server · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [Saleor throttling.py get_client_ip excessive authentication](https://agentprime.io/advisories/CVE-2026-93650.md)
  `CVE-2026-93650` · CVE record: Saleor · CVSS 6.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-799
- [SysReptor: Session Fixation in Password-Protected Shared Notes](https://agentprime.io/advisories/CVE-2026-81181.md)
  `CVE-2026-81181` · CVE record: Syslifters sysreptor · CVSS 3.7 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools](https://agentprime.io/advisories/GHSA-5gm3-9crp-6g3v.md)
  `GHSA-5gm3-9crp-6g3v`, `CVE-2026-77339`, `GO-2026-6515` · Go `github.com/f1bonacc1/process-compose`: affected `<1.120.0`, fixed in `1.120.0` · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-346
- [ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement](https://agentprime.io/advisories/GHSA-qg2g-g9w3-m5h8.md)
  `GHSA-qg2g-g9w3-m5h8`, `CVE-2026-58197`, `GO-2026-6526` · Go `github.com/stacklok/toolhive`: affected `<0.30.1`, fixed in `0.30.1` · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control, Authentication bypass
- [kcp front-proxy does not strip inbound X-Remote-\* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace](https://agentprime.io/advisories/GHSA-c8w2-fgvx-vhv4.md)
  `GHSA-c8w2-fgvx-vhv4`, `CVE-2026-61682`, `GO-2026-6517` · Go `github.com/kcp-dev/kcp`: affected `<0.31.4 || >=0.32.0, <0.32.2`, fixed in `0.31.4`, `0.32.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-302, CWE-348
- [Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication](https://agentprime.io/advisories/CVE-2026-93559.md)
  `CVE-2026-93559` · CVE record: Forget-C Jellyfish AI Short Drama Studio · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [CareCam CM2507 Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-85478.md)
  `CVE-2026-85478` · CVE record: CareCam HMT.CM2507 Firmware · CVSS 2.4 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [CareCam CM2507 Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-84400.md)
  `CVE-2026-84400` · CVE record: CareCam HMT.CM2507 Firmware · CVSS 2.3 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [CareCam CM2507 Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-88259.md)
  `CVE-2026-88259` · CVE record: CareCam HMT.CM2507 Firmware · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [gedelumbung HospitalManagement Password Change password.php simpan improper authentication](https://agentprime.io/advisories/CVE-2026-93532.md)
  `CVE-2026-93532` · CVE record: gedelumbung HospitalManagement · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2](https://agentprime.io/advisories/CVE-2026-85511.md)
  `CVE-2026-85511` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 4.2 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0](https://agentprime.io/advisories/CVE-2026-92976.md)
  `CVE-2026-92976` · CVE record: T-Systems TAO · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass
- [Unlimited authentication attempts in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-40538.md)
  `CVE-2026-40538` · CVE record: Synology DiskStation Manager (DSM) · CVSS 3.7 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA5LTE4VDA4OjI5OjE1Ljg3ODAwMFoiLCJDVkUtMjAyNi00MDUzOCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA5LTIyVDIwOjM3OjExLjAwMDAwMFoiLCJHSFNBLTl4aG0tdzN3ai14aHFoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA5LTIyVDIwOjM3OjExLjAwMDAwMFoiLCJHSFNBLTl4aG0tdzN3ai14aHFoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.