# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint](https://agentprime.io/advisories/CVE-2026-107204.md)
  `CVE-2026-107204` · CVE record: LMCache LMCache · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Authenticated SMTP Sender Address Forgery](https://agentprime.io/advisories/CVE-2026-33586.md)
  `CVE-2026-33586` · CVE record: OVHcloud OVHcloud · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-346, CWE-1188
- [PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents](https://agentprime.io/advisories/GHSA-7c92-x8vg-4258.md)
  `GHSA-7c92-x8vg-4258`, `CVE-2026-61436`, `PYSEC-2026-4252` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing](https://agentprime.io/advisories/GHSA-qj9c-59p6-8cgx.md)
  `GHSA-qj9c-59p6-8cgx`, `CVE-2026-61428`, `PYSEC-2026-4259` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [wger: API credentials remain valid after logout/password change](https://agentprime.io/advisories/GHSA-v3x9-6gg8-c2c9.md)
  `GHSA-v3x9-6gg8-c2c9`, `CVE-2026-46437`, `PYSEC-2026-4315` · PyPI `wger`: affected `<=2.1`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass in Sungrow iSolarCloud](https://agentprime.io/advisories/CVE-2026-107194.md)
  `CVE-2026-107194` · CVE record: Sungrow iSolarCloud · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances](https://agentprime.io/advisories/CVE-2026-107180.md)
  `CVE-2026-107180` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass](https://agentprime.io/advisories/CVE-2026-107162.md)
  `CVE-2026-107162` · CVE record: ExpressGateway express-gateway · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests](https://agentprime.io/advisories/CVE-2026-107151.md)
  `CVE-2026-107151` · CVE record: Red Hat Red Hat Satellite 6 · CVSS 5.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transport](https://agentprime.io/advisories/GHSA-vv44-hjm2-qw2f.md)
  `GHSA-vv44-hjm2-qw2f` · PyPI `lmcache`: affected `>=0.3.9`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Apache YuniKorn: Admission control bypass via system label forgery](https://agentprime.io/advisories/CVE-2026-97146.md)
  `CVE-2026-97146` · CVE record: Apache Software Foundation Apache YuniKorn · CVSS 4.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Apache Impala: Impala Executor Webserver Auth Bypass](https://agentprime.io/advisories/CVE-2026-97720.md)
  `CVE-2026-97720` · CVE record: Apache Software Foundation Apache Impala · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-19572.md)
  `CVE-2026-19572` · CVE record: Flexera FlexNet Publisher · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [wolfSSHd on Windows race condition leading to logon token reused across connections](https://agentprime.io/advisories/CVE-2026-83540.md)
  `CVE-2026-83540` · CVE record: wolfSSL wolfSSH · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.](https://agentprime.io/advisories/CVE-2025-70520.md)
  `CVE-2025-70520` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.](https://agentprime.io/advisories/CVE-2025-70516.md)
  `CVE-2025-70516` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Gitea OAuth2 refresh token grant accepts access tokens](https://agentprime.io/advisories/CVE-2026-101023.md)
  `CVE-2026-101023` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Security Advisory 0190](https://agentprime.io/advisories/CVE-2026-102161.md)
  `CVE-2026-102161` · CVE record: Arista Networks CloudVision CUE · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [Security Advisory 0190](https://agentprime.io/advisories/CVE-2026-102159.md)
  `CVE-2026-102159` · CVE record: Arista Networks CloudVision CUE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Gitea WebAuthn bypass during OAuth and OIDC sign-in](https://agentprime.io/advisories/CVE-2026-73278.md)
  `CVE-2026-73278` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Gitea installer authentication bypass for existing accounts](https://agentprime.io/advisories/CVE-2026-96404.md)
  `CVE-2026-96404` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-79818.md)
  `CVE-2026-79818` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Vulnerabilities in ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-79796.md)
  `CVE-2026-79796` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-76752.md)
  `CVE-2026-76752` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Vulnerability in the Management Interface of AOS-S](https://agentprime.io/advisories/CVE-2026-76743.md)
  `CVE-2026-76743` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [CVE-2026-106511](https://agentprime.io/advisories/CVE-2026-106511.md)
  `CVE-2026-106511` · CVE record: MultiversX Labs S.R.L. multisig-improved · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Authentication bypass by replay in Devolutions Server](https://agentprime.io/advisories/CVE-2026-105485.md)
  `CVE-2026-105485` · CVE record: Devolutions Server · CVSS 6.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass by replay in Devolutions Server](https://agentprime.io/advisories/CVE-2026-9226.md)
  `CVE-2026-9226` · CVE record: Devolutions Server · CVSS 6.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Container Storage Modules](https://agentprime.io/advisories/CVE-2026-63690.md)
  `CVE-2026-63690` · CVE record: Dell Container Storage Modules · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Container Storage Modules (CSM)](https://agentprime.io/advisories/CVE-2026-70411.md)
  `CVE-2026-70411` · CVE record: Dell Container Storage Modules (CSM) · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Container Storage Modules](https://agentprime.io/advisories/CVE-2026-63692.md)
  `CVE-2026-63692` · CVE record: Dell Container Storage Modules · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Container Storage Modules (CSM)](https://agentprime.io/advisories/CVE-2026-63688.md)
  `CVE-2026-63688` · CVE record: Dell Dell Container Storage Modules (CSM) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs](https://agentprime.io/advisories/CVE-2026-106038.md)
  `CVE-2026-106038` · CVE record: kvcache-ai Mooncake · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service](https://agentprime.io/advisories/CVE-2026-106037.md)
  `CVE-2026-106037` · CVE record: kvcache-ai Mooncake · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint](https://agentprime.io/advisories/CVE-2026-105835.md)
  `CVE-2026-105835` · CVE record: planka planka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-105057.md)
  `CVE-2026-105057` · CVE record: Ben Marshall Zero Spam · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-100518.md)
  `CVE-2026-100518` · CVE record: WebFactory Advanced Google reCAPTCHA · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-97308.md)
  `CVE-2026-97308` · CVE record: WebFactory Login Lockdown · CVSS 4.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-39793.md)
  `CVE-2026-39793` · CVE record: Nicu Micle Simple JWT Login · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-39772.md)
  `CVE-2026-39772` · CVE record: bestwebsoft Captcha by BestWebSoft · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-39769.md)
  `CVE-2026-39769` · CVE record: Iqonic Designs Graphina – Charts and Graphs For Elementor · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement](https://agentprime.io/advisories/CVE-2026-105305.md)
  `CVE-2026-105305` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type](https://agentprime.io/advisories/CVE-2026-59358.md)
  `CVE-2026-59358` · CVE record: Cloud Foundry UAA and 1 more · CVSS 7.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Missing authentication for critical function in the aas-edge-client REST API](https://agentprime.io/advisories/CVE-2026-94293.md)
  `CVE-2026-94293` · CVE record: Murrelektronik Software AAS Edge Client all versions · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return](https://agentprime.io/advisories/CVE-2026-94271.md)
  `CVE-2026-94271` · CVE record: Unknown Deema Payment Gateway · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook](https://agentprime.io/advisories/CVE-2026-94270.md)
  `CVE-2026-94270` · CVE record: Unknown Deema Payment Gateway · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability](https://agentprime.io/advisories/CVE-2026-41558.md)
  `CVE-2026-41558` · CVE record: WP Synchro WP Migration Plugin DB & Files – WP Synchro · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [SourceCodester Drug Recommendation System Auth Guard improper authentication](https://agentprime.io/advisories/CVE-2026-105704.md)
  `CVE-2026-105704` · CVE record: SourceCodester Drug Recommendation System · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [OSSRS srs System API api.go systemAPI.Run missing authentication](https://agentprime.io/advisories/CVE-2026-105486.md)
  `CVE-2026-105486` · CVE record: OSSRS srs · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Filament: Multi-factor authentication (app) management actions do not require password reauthentication](https://agentprime.io/advisories/GHSA-7m6h-rg42-m449.md)
  `GHSA-7m6h-rg42-m449`, `CVE-2026-104181`, `PKSA-cnr1-6g7k-bp3d` · Packagist `filament/filament`: affected `>=4.0.0, <4.13.3 || >=5.0.0, <5.8.3`, fixed in `4.13.3`, `5.8.3` · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://agentprime.io/advisories/GHSA-jqcg-44mw-7w3h.md)
  `GHSA-jqcg-44mw-7w3h`, `CVE-2026-90711` · npm `proxy-addr`: affected `>=1.1.0, <2.0.8`, fixed in `2.0.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, CWE-348, CWE-697
- [Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier](https://agentprime.io/advisories/CVE-2026-105786.md)
  `CVE-2026-105786` · CVE record: laurent22 joplin · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS, Broken access control
- [CVE-2026-82988](https://agentprime.io/advisories/CVE-2026-82988.md)
  `CVE-2026-82988` · CVE record: Viewsonic vCast · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, Unrestricted file upload, Insecure deserialization
- [Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass](https://agentprime.io/advisories/GHSA-cf6m-vc3m-7cgm.md)
  `GHSA-cf6m-vc3m-7cgm`, `CVE-2026-8505`, `PYSEC-2026-4233` · PyPI `langflow`: affected `>=1.7.0, <1.9.1`, fixed in `1.9.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional](https://agentprime.io/advisories/CVE-2026-71297.md)
  `CVE-2026-71297` · CVE record: Red Hat Multicluster Engine for Kubernetes · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access](https://agentprime.io/advisories/CVE-2026-105690.md)
  `CVE-2026-105690` · CVE record: penpot penpot · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Maestro: maestro: rest api write endpoints registered without authentication middleware](https://agentprime.io/advisories/CVE-2026-71299.md)
  `CVE-2026-71299` · CVE record: Red Hat Multicluster Engine for Kubernetes · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)](https://agentprime.io/advisories/CVE-2026-105640.md)
  `CVE-2026-105640` · CVE record: makeplane plane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane](https://agentprime.io/advisories/CVE-2026-105639.md)
  `CVE-2026-105639` · CVE record: makeplane plane · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control
- [Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force](https://agentprime.io/advisories/CVE-2026-105638.md)
  `CVE-2026-105638` · CVE record: makeplane plane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTA1VDE4OjA5OjM1LjY0OTAwMFoiLCJDVkUtMjAyNi0xMDU2MzgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTA3VDE1OjI0OjA0LjAyODAwMFoiLCJDVkUtMjAyNi0xMDcyMDUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTA3VDE1OjI0OjA0LjAyODAwMFoiLCJDVkUtMjAyNi0xMDcyMDUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.