# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [dbt: Unauthenticated Arbitrary SQL Execution in \`dbt docs serve\`](https://agentprime.io/advisories/CVE-2026-100406.md)
  `CVE-2026-100406` · CVE record: dbt-labs dbt-core · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal, Information disclosure, Authentication bypass
- [LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session](https://agentprime.io/advisories/CVE-2026-55167.md)
  `CVE-2026-55167` · CVE record: LDAPAccountManager lam · CVSS 4.2 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server](https://agentprime.io/advisories/CVE-2026-106465.md)
  `CVE-2026-106465` · CVE record: Eclipse Foundation Eclipse ThreadX NetX Duo · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-406
- [Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer](https://agentprime.io/advisories/CVE-2026-107350.md)
  `CVE-2026-107350` · CVE record: PgBouncer · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled](https://agentprime.io/advisories/CVE-2026-101954.md)
  `CVE-2026-101954` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718](https://agentprime.io/advisories/CVE-2026-109439.md)
  `CVE-2026-109439` · CVE record: LANTRONIX XPress-DR and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting](https://agentprime.io/advisories/CVE-2026-93637.md)
  `CVE-2026-93637` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution](https://agentprime.io/advisories/CVE-2026-101986.md)
  `CVE-2026-101986` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Junos OS: Unauthorized root command execution when J-Web is enabled](https://agentprime.io/advisories/CVE-2026-101956.md)
  `CVE-2026-101956` · CVE record: Juniper Networks Junos OS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Zulip: OpenID Connect authentication ignores the email_verified claim](https://agentprime.io/advisories/CVE-2026-102893.md)
  `CVE-2026-102893` · CVE record: zulip zulip · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [MOVEit Transfer Identity validation flaw in SFTP authentication](https://agentprime.io/advisories/CVE-2026-89077.md)
  `CVE-2026-89077` · CVE record: Progress MOVEit Transfer · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [MOVEit Transfer Access restriction bypass in OAuth authentication](https://agentprime.io/advisories/CVE-2026-89073.md)
  `CVE-2026-89073` · CVE record: Progress MOVEit Transfer · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [MOVEit Transfer OIDC Authentication Replay Vulnerability](https://agentprime.io/advisories/CVE-2026-89070.md)
  `CVE-2026-89070` · CVE record: Progress MOVEit Transfer · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [MOVEit Transfer Authentication bypass in LDAP sign-on](https://agentprime.io/advisories/CVE-2026-89068.md)
  `CVE-2026-89068` · CVE record: Progress MOVEit Transfer · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [MOVEit Transfer Secure Messaging Authentication Bypass](https://agentprime.io/advisories/CVE-2026-89067.md)
  `CVE-2026-89067` · CVE record: Progress MOVEit Transfer · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [NGINX Ingress Controller vulnerability](https://agentprime.io/advisories/CVE-2026-104939.md)
  `CVE-2026-104939` · CVE record: F5 NGINX Ingress Controller · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [NGINX Ingress Controller vulnerability](https://agentprime.io/advisories/CVE-2026-94197.md)
  `CVE-2026-94197` · CVE record: F5 NGINX Ingress Controller · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [NGINX Gateway Fabric vulnerability](https://agentprime.io/advisories/CVE-2026-96615.md)
  `CVE-2026-96615` · CVE record: F5 NGINX Gateway Fabric · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Gitea second-factor bypass through OpenID identity linking](https://agentprime.io/advisories/CVE-2026-73535.md)
  `CVE-2026-73535` · CVE record: Gitea Gitea · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-696
- [Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE](https://agentprime.io/advisories/CVE-2026-110632.md)
  `CVE-2026-110632` · CVE record: Report One MyReport Updater · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints](https://agentprime.io/advisories/CVE-2026-110619.md)
  `CVE-2026-110619` · CVE record: fatedier frp · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API](https://agentprime.io/advisories/CVE-2026-110618.md)
  `CVE-2026-110618` · CVE record: pppscn SmsForwarder · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [NullHub through 2026.5.29 Missing Authentication for /api Management API](https://agentprime.io/advisories/CVE-2026-110616.md)
  `CVE-2026-110616` · CVE record: nullclaw NullHub · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP](https://agentprime.io/advisories/CVE-2026-16740.md)
  `CVE-2026-16740` · CVE record: TR7 Cyber Defense Inc. TR7 ASP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability](https://agentprime.io/advisories/CVE-2026-107421.md)
  `CVE-2026-107421` · CVE record: VideoWhisper.com Broadcast Live Video · CVSS 7.3 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Improper Multi-Factor Authentication Validation Allows Authentication Bypass](https://agentprime.io/advisories/CVE-2026-108071.md)
  `CVE-2026-108071` · CVE record: TSplus TSplus Remote Access · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop](https://agentprime.io/advisories/CVE-2026-103905.md)
  `CVE-2026-103905` · CVE record: JTL-Software GmbH JTL-Shop · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask](https://agentprime.io/advisories/CVE-2026-109969.md)
  `CVE-2026-109969` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback](https://agentprime.io/advisories/CVE-2026-100163.md)
  `CVE-2026-100163` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 7.4 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook](https://agentprime.io/advisories/CVE-2026-87974.md)
  `CVE-2026-87974` · CVE record: Unknown Asaas Gateway for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices](https://agentprime.io/advisories/CVE-2026-108473.md)
  `CVE-2026-108473` · CVE record: TP-Link Systems Inc. HS103 v5 and 4 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in OpenVPN](https://agentprime.io/advisories/CVE-2026-84790.md)
  `CVE-2026-84790` · CVE record: OpenVPN OpenVPN · CVSS 7.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass, CWE-158
- [Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-vrrp-6v32-2p8g.md)
  `GHSA-vrrp-6v32-2p8g`, `CVE-2026-70179` · NuGet `Microsoft.AspNetCore.Authentication.Negotiate`: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13`, fixed in `8.0.32`, `9.0.21`, `10.0.13` · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [IBM WebSphere Application Server Liberty is affected by an authentication bypass](https://agentprime.io/advisories/CVE-2026-93909.md)
  `CVE-2026-93909` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Missing Verification of auth_time Claim in auth0.js](https://agentprime.io/advisories/CVE-2026-107371.md)
  `CVE-2026-107371` · CVE record: Auth0 auth0.js · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Omnispace Agora Project < 26.10.0 Session Fixation via Authentication](https://agentprime.io/advisories/CVE-2026-63161.md)
  `CVE-2026-63161` · CVE record: Omnispace Agora Project · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check](https://agentprime.io/advisories/CVE-2026-110130.md)
  `CVE-2026-110130` · CVE record: Finsys dockhand · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Active Directory Federation Services (AD FS) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-108131.md)
  `CVE-2026-108131` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Windows Schannel Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-105008.md)
  `CVE-2026-105008` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass, CWE-420
- [Windows Setup and Deployment Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-97793.md)
  `CVE-2026-97793` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Security Account Manager Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-96858.md)
  `CVE-2026-96858` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69802.md)
  `CVE-2026-69802` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Azure Key Vault Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-85922.md)
  `CVE-2026-85922` · CVE record: Microsoft azure_security_keyvault_certificates and 4 more · CVSS 7.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85884.md)
  `CVE-2026-85884` · CVE record: Microsoft Windows 11 Version 24H2 and 3 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Internet (wininet.dll) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-83845.md)
  `CVE-2026-83845` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Error Reporting Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83840.md)
  `CVE-2026-83840` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Modern Device Management (MDM) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-83656.md)
  `CVE-2026-83656` · CVE record: Microsoft Windows 10 Version 21H2 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Active Directory Federation Services (AD FS) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-83511.md)
  `CVE-2026-83511` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows SmartScreen Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-62879.md)
  `CVE-2026-62879` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Push Notifications Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-96313.md)
  `CVE-2026-96313` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Remote Access Connection Manager Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70137.md)
  `CVE-2026-70137` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-70005.md)
  `CVE-2026-70005` · CVE record: Microsoft Windows Server 2019 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69982.md)
  `CVE-2026-69982` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Kernel Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-85939.md)
  `CVE-2026-85939` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Active Directory Federation Services (AD FS) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-83674.md)
  `CVE-2026-83674` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88101.md)
  `CVE-2026-88101` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows DHCP Server Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-85865.md)
  `CVE-2026-85865` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Print Spooler Components Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85376.md)
  `CVE-2026-85376` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Windows Projected File System Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85328.md)
  `CVE-2026-85328` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [Network Device Enrollment Service (NDES) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-85323.md)
  `CVE-2026-85323` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTEzVDE5OjAwOjAxLjYwNTAwMFoiLCJDVkUtMjAyNi04NTMyMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTE0VDE4OjMxOjM3LjIyODAwMFoiLCJDVkUtMjAyNi0xMDk1MDYiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTE0VDE4OjMxOjM3LjIyODAwMFoiLCJDVkUtMjAyNi0xMDk1MDYiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.