# Authentication bypass. Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Missing authentication in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-78025.md) `CVE-2026-78025` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass - [Unlimited authentication attempts in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-76779.md) `CVE-2026-76779` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 7.4 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass - [Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling](https://agentprime.io/advisories/CVE-2026-107910.md) `CVE-2026-107910` · CVE record: FalkorDB FalkorDB · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass - [Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB](https://agentprime.io/advisories/CVE-2026-105672.md) `CVE-2026-105672` · CVE record: TP-Link Systems Inc. Tapo C325WB v2 · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Azure App Service Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-77900.md) `CVE-2026-77900` · CVE record: Microsoft Azure App Service for Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [fast-jwt: Verifier cache accepts expired JWTs without iat.](https://agentprime.io/advisories/GHSA-x937-hj6v-793p.md) `GHSA-x937-hj6v-793p`, `CVE-2026-107719` · npm `fast-jwt`: affected `<6.3.4`, fixed in `6.3.4` · CVSS 4.2 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)](https://agentprime.io/advisories/GHSA-687g-22h4-j4w4.md) `GHSA-687g-22h4-j4w4`, `CVE-2026-107721` · npm `fast-jwt`: affected `<6.3.0`, fixed in `6.3.0` · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-682 - [PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure](https://agentprime.io/advisories/GHSA-6wjp-v33h-5cvq.md) `GHSA-6wjp-v33h-5cvq`, `CVE-2026-61426` · npm `praisonai`: affected `<1.7.3`, fixed in `1.7.3` · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Broken access control, Authentication bypass - [PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface](https://agentprime.io/advisories/GHSA-hc5v-gxvj-58wh.md) `GHSA-hc5v-gxvj-58wh`, `CVE-2026-61427`, `PYSEC-2026-4257` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-20 - [PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF](https://agentprime.io/advisories/GHSA-4w49-gwv8-fpjg.md) `GHSA-4w49-gwv8-fpjg`, `CVE-2026-60091`, `PYSEC-2026-4249` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Authentication bypass, Race condition, Server-side request forgery (SSRF) - [IBM Guardium Data Protection is affected by vulnerability](https://agentprime.io/advisories/CVE-2026-84249.md) `CVE-2026-84249` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer](https://agentprime.io/advisories/CVE-2026-11318.md) `CVE-2026-11318` · CVE record: Zuler Technology DeskIn · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-16823.md) `CVE-2026-16823` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-19491.md) `CVE-2026-19491` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-19494.md) `CVE-2026-19494` · CVE record: IBM Security Verify Access and 3 more · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE](https://agentprime.io/advisories/CVE-2026-107779.md) `CVE-2026-107779` · CVE record: dromara skyeye · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [PraisonAI: Call API localhost-only authentication bypass via spoofed Host header](https://agentprime.io/advisories/GHSA-2gpf-2492-q9jh.md) `GHSA-2gpf-2492-q9jh`, `CVE-2026-61435`, `PYSEC-2026-4247` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-346 - [TVU Networks Receiver/Transceiver Missing Authentication via REST API](https://agentprime.io/advisories/CVE-2026-104076.md) `CVE-2026-104076` · CVE record: TVU Networks TVU Receiver / Transceiver · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login](https://agentprime.io/advisories/CVE-2026-104075.md) `CVE-2026-104075` · CVE record: TVU Networks TVU Receiver / Transceiver · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [IBM Guardium Data Protection Missing Authentication](https://agentprime.io/advisories/CVE-2026-84272.md) `CVE-2026-84272` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Authentication Bypass Using an Alternate Path or Channel in Malcolm](https://agentprime.io/advisories/CVE-2026-107361.md) `CVE-2026-107361` · CVE record: CISA Malcolm · CVSS 4.2 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Authentication Bypass by Spoofing in Malcolm](https://agentprime.io/advisories/CVE-2026-107336.md) `CVE-2026-107336` · CVE record: CISA Malcolm · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-441 - [AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)](https://agentprime.io/advisories/GHSA-2jwh-9rmr-j4xf.md) `GHSA-2jwh-9rmr-j4xf`, `CVE-2026-107228` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1`, fixed in `3.0.14` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS](https://agentprime.io/advisories/GHSA-p2jm-6hj6-9rjg.md) `GHSA-p2jm-6hj6-9rjg`, `CVE-2026-107226` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1`, fixed in `3.0.14` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-693 - [Authentication Bypass by Spoofing in Jacamar CI](https://agentprime.io/advisories/CVE-2026-107589.md) `CVE-2026-107589` · CVE record: Jacamar CI Jacamar CI · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx](https://agentprime.io/advisories/CVE-2026-9209.md) `CVE-2026-9209` · CVE record: mJob mJobTime · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation, Authentication bypass - [pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php](https://agentprime.io/advisories/CVE-2026-107638.md) `CVE-2026-107638` · CVE record: ph7software ph7builder · CVSS 7.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes](https://agentprime.io/advisories/CVE-2026-105832.md) `CVE-2026-105832` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [IBM DataPower Gateway Improper Authentication](https://agentprime.io/advisories/CVE-2026-14502.md) `CVE-2026-14502` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed](https://agentprime.io/advisories/CVE-2026-107275.md) `CVE-2026-107275` · CVE record: @fastify/jwt @fastify/jwt · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-390, CWE-754 - [Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter](https://agentprime.io/advisories/CVE-2026-105110.md) `CVE-2026-105110` · CVE record: Iskratel Innbox · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, Authentication bypass - [Authentication bypass in multiple products from Frappe Technologies](https://agentprime.io/advisories/CVE-2026-4894.md) `CVE-2026-4894` · CVE record: Frappe Technologies Frappe Technologies · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Missing authentication in Brocade Active Support Connectivity Gateway](https://agentprime.io/advisories/CVE-2026-85489.md) `CVE-2026-85489` · CVE record: Brocade Brocade Active Support Connectivity Gateway · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Missing authentication in Brocade Active Support Connectivity Gateway](https://agentprime.io/advisories/CVE-2026-85423.md) `CVE-2026-85423` · CVE record: Brocade Brocade Active Support Connectivity Gateway · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Missing authentication in Brocade Active Support Connectivity Gateway](https://agentprime.io/advisories/CVE-2026-85421.md) `CVE-2026-85421` · CVE record: Brocade Brocade Active Support Connectivity Gateway · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter](https://agentprime.io/advisories/CVE-2026-103646.md) `CVE-2026-103646` · CVE record: Unknown Ultimate Multisite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Authentication bypass in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-94585.md) `CVE-2026-94585` · CVE record: Brocade Fabric OS · CVSS 7.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Missing authentication in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87664.md) `CVE-2026-87664` · CVE record: Brocade Fabric OS · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Authentication bypass by spoofing in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87663.md) `CVE-2026-87663` · CVE record: Brocade Fabric OS · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Authentication bypass by spoofing in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87670.md) `CVE-2026-87670` · CVE record: Brocade Fabric OS · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Authentication bypass by spoofing in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87686.md) `CVE-2026-87686` · CVE record: Brocade Fabric OS · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Missing authentication in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87659.md) `CVE-2026-87659` · CVE record: Brocade Fabric OS · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [Potential brute force vulnerability due to non-expiring SMS OTPs](https://agentprime.io/advisories/CVE-2024-8122.md) `CVE-2024-8122` · CVE record: WSO2 WSO2 Identity Server · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass - [AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int](https://agentprime.io/advisories/CVE-2026-107279.md) `CVE-2026-107279` · CVE record: AsyncHttpClient async-http-client · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-757 - [AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts](https://agentprime.io/advisories/CVE-2026-107229.md) `CVE-2026-107229` · CVE record: AsyncHttpClient async-http-client · CVSS 4.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-1275 - [Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76268.md) `CVE-2026-76268` · CVE record: Splunk Splunk Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [Payload: Unauthenticated account-lockout denial of service](https://agentprime.io/advisories/GHSA-v5gf-vpjc-pc7w.md) `GHSA-v5gf-vpjc-pc7w`, `CVE-2026-105866` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-645 - [Payload authentication token field handling issue](https://agentprime.io/advisories/GHSA-66wr-7vmr-p5jq.md) `GHSA-66wr-7vmr-p5jq`, `CVE-2026-105863` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Broken access control - [Backstage: Insufficient audience validation in the Cloudflare Access auth provider](https://agentprime.io/advisories/GHSA-q333-f498-w2x7.md) `GHSA-q333-f498-w2x7`, `CVE-2026-106457` · npm `@backstage/plugin-auth-backend-module-cloudflare-access-provider`: affected `>=0.1.0, <0.5.0`, fixed in `0.5.0` · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization](https://agentprime.io/advisories/GHSA-xm5q-p7w3-x6cp.md) `GHSA-xm5q-p7w3-x6cp`, `CVE-2026-106460` · npm `@backstage/plugin-auth-node`: affected `>=0.3.0, <0.6.15 || >=0.7.0, <0.7.5`, fixed in `0.6.15`, `0.7.5` · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control](https://agentprime.io/advisories/GHSA-jg6q-3qfh-r9f8.md) `GHSA-jg6q-3qfh-r9f8`, `CVE-2026-104891` · npm `@insumermodel/mppx-condition-gate` and 1 more: affected `<3.0.0`, fixed in `3.0.0` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Broken access control - [Backstage: Improper authentication in the OIDC provider](https://agentprime.io/advisories/GHSA-826h-28h9-65hg.md) `GHSA-826h-28h9-65hg`, `CVE-2026-106488` · npm `@backstage/plugin-auth-backend-module-oidc-provider`: affected `<0.4.20`, fixed in `0.4.20` · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [Blind VXLAN injection into encrypted overlay networks from cluster peer](https://agentprime.io/advisories/CVE-2026-92542.md) `CVE-2026-92542` · CVE record: Docker Docker Engine and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [Langflow: IP Spoofing Bypass via \`X-Forwarded-For\` Allowing Remote Configuration Write](https://agentprime.io/advisories/GHSA-4f6c-2vvp-gw82.md) `GHSA-4f6c-2vvp-gw82`, `CVE-2026-105741`, `PYSEC-2026-4229` · PyPI `langflow`: affected `>=1.5.0, <1.10.3`, fixed in `1.10.3` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-345 - [Cisco License On-Prem Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76480.md) `CVE-2026-76480` · CVE record: Cisco Cisco License On-Prem · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)](https://agentprime.io/advisories/GHSA-rqcc-94gv-wjm9.md) `GHSA-rqcc-94gv-wjm9`, `CVE-2026-62253`, `GO-2026-6673` · Go `github.com/sipcapture/homer-app`: affected `<0.0.0-20260625093330-5e90809657c9`, fixed in `0.0.0-20260625093330-5e90809657c9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens](https://agentprime.io/advisories/CVE-2026-92414.md) `CVE-2026-92414` · CVE record: Apache Software Foundation Apache Jackrabbit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass](https://agentprime.io/advisories/CVE-2026-107207.md) `CVE-2026-107207` · CVE record: LMCache LMCache · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API](https://agentprime.io/advisories/CVE-2026-107206.md) `CVE-2026-107206` · CVE record: LMCache LMCache · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass - [LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API](https://agentprime.io/advisories/CVE-2026-107205.md) `CVE-2026-107205` · CVE record: LMCache LMCache · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .