# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs](https://agentprime.io/advisories/CVE-2026-111624.md)
  `CVE-2026-111624` · CVE record: umbraco Umbraco-CMS · CVSS 6.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance](https://agentprime.io/advisories/CVE-2026-111623.md)
  `CVE-2026-111623` · CVE record: joey-zhou xiaozhi-esp32-server-java · CVSS 6.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints](https://agentprime.io/advisories/CVE-2026-111617.md)
  `CVE-2026-111617` · CVE record: MGdaasLab WHartTest · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test](https://agentprime.io/advisories/CVE-2026-111613.md)
  `CVE-2026-111613` · CVE record: alldatacenter alldata · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Dockhand: Unauthenticated container exec via WebSocket upgrade](https://agentprime.io/advisories/CVE-2026-57169.md)
  `CVE-2026-57169` · CVE record: Finsys dockhand · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass, Broken access control
- [J4Care dcm4che Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-105667.md)
  `CVE-2026-105667` · CVE record: J4Care dcm4chee-arc-light · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [J4Care dcm4che Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-105279.md)
  `CVE-2026-105279` · CVE record: J4Care dcm4chee-arc-light · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Apache Kylin: Missing authentication on certain cache API endpoints](https://agentprime.io/advisories/CVE-2026-64959.md)
  `CVE-2026-64959` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection, Authentication bypass
- [ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation](https://agentprime.io/advisories/GHSA-p8wx-ph99-xgcr.md)
  `GHSA-p8wx-ph99-xgcr` · Go `github.com/traefik/traefik/v3`: affected `>=v3.7.0-ea.1, <=v3.7.14`, fixed in `v3.7.15` · CVSS 7.0 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass, CWE-636
- [Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials](https://agentprime.io/advisories/CVE-2026-75903.md)
  `CVE-2026-75903` · CVE record: manuelgalan Vulnity Security · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force](https://agentprime.io/advisories/CVE-2026-110135.md)
  `CVE-2026-110135` · CVE record: Unknown OTP Login & Register Woocommerce · CVSS 7.4 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token](https://agentprime.io/advisories/CVE-2026-110013.md)
  `CVE-2026-110013` · CVE record: Unknown Salon Booking System · CVSS 4.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State](https://agentprime.io/advisories/CVE-2026-103895.md)
  `CVE-2026-103895` · CVE record: cyberlord92 miniOrange OTP Login, Verification and SMS Notifications · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass in Lenovo Idea Tab Pro (TB373FU) and others](https://agentprime.io/advisories/CVE-2026-89057.md)
  `CVE-2026-89057` · CVE record: Lenovo Idea Tab Pro (TB373FU) and 4 more · CVSS 7.0 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force](https://agentprime.io/advisories/CVE-2026-111356.md)
  `CVE-2026-111356` · CVE record: magicblack MacCMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Archon 0.2.13 through 0.11.1 Missing Authentication via /api/\* Control API](https://agentprime.io/advisories/CVE-2026-111322.md)
  `CVE-2026-111322` · CVE record: coleam00 Archon · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [OpenHealth through 0.2.0 Missing Authentication via /api/health-data/\[id\] Route](https://agentprime.io/advisories/CVE-2026-111312.md)
  `CVE-2026-111312` · CVE record: OpenHealthForAll OpenHealth · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token](https://agentprime.io/advisories/CVE-2026-96806.md)
  `CVE-2026-96806` · CVE record: Apache Software Foundation Apache Airflow Keycloak provider · CVSS 5.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching](https://agentprime.io/advisories/CVE-2026-105038.md)
  `CVE-2026-105038` · CVE record: EnergizeLab FastAPI AI inference server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers](https://agentprime.io/advisories/CVE-2026-105034.md)
  `CVE-2026-105034` · CVE record: EnergizeLab NestJS auth service · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support](https://agentprime.io/advisories/CVE-2026-102764.md)
  `CVE-2026-102764` · CVE record: BeyondTrust Remote Support · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.78 · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service](https://agentprime.io/advisories/GHSA-qj98-gp63-54xj.md)
  `GHSA-qj98-gp63-54xj`, `CVE-2026-102748` · Go `github.com/dgraph-io/dgraph/v25`: affected `<25.4.0`, fixed in `25.4.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools](https://agentprime.io/advisories/GHSA-vc32-4gwf-77xp.md)
  `GHSA-vc32-4gwf-77xp`, `CVE-2026-84360`, `GO-2026-6799` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable](https://agentprime.io/advisories/GHSA-wq4w-vwvq-q3x9.md)
  `GHSA-wq4w-vwvq-q3x9`, `CVE-2026-84321`, `GO-2026-6801` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Nginx UI: Casdoor SSO callback uses a constant \`state\` parameter (login CSRF)](https://agentprime.io/advisories/GHSA-44xr-mrhh-qm78.md)
  `GHSA-44xr-mrhh-qm78`, `CVE-2026-84312`, `GO-2026-6773` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover](https://agentprime.io/advisories/GHSA-gfrc-g87h-7h5w.md)
  `GHSA-gfrc-g87h-7h5w`, `CVE-2026-84313`, `GO-2026-6786` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [ZoneMinder failed token handling bypasses web authentication](https://agentprime.io/advisories/CVE-2026-104198.md)
  `CVE-2026-104198` · CVE record: ZoneMinder zoneminder · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, CWE-697
- [Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs](https://agentprime.io/advisories/CVE-2026-57183.md)
  `CVE-2026-57183` · CVE record: Erudika scoold · CVSS 6.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json](https://agentprime.io/advisories/CVE-2026-102946.md)
  `CVE-2026-102946` · CVE record: authlib joserfc · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-345
- [Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS](https://agentprime.io/advisories/CVE-2026-84731.md)
  `CVE-2026-84731` · CVE record: Nutanix Acropolis Operating System (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, CWE-302
- [authd: Account takeover via username fallback in identity matching after IdP email reassignment](https://agentprime.io/advisories/CVE-2026-102631.md)
  `CVE-2026-102631` · CVE record: Canonical authd · CVSS 5.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks](https://agentprime.io/advisories/CVE-2026-61611.md)
  `CVE-2026-61611` · CVE record: LycheeOrg Lychee · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Unitronics - CWE-287: Improper Authentication](https://agentprime.io/advisories/CVE-2026-45451.md)
  `CVE-2026-45451` · CVE record: Unitronics Unitronics UniStream Pro/UniLogic · CVSS 8.3 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Eclipse Foundation Eclipse Connected Services Platform](https://agentprime.io/advisories/CVE-2026-110723.md)
  `CVE-2026-110723` · CVE record: Eclipse Foundation Eclipse Connected Services Platform · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, CWE-644
- [Jetty EthereumAuthenticator unanchored login-path matching bypasses authentication and role constraints](https://agentprime.io/advisories/GHSA-6m7j-pjmp-crgq.md)
  `GHSA-6m7j-pjmp-crgq`, `CVE-2026-19863` · Maven `org.eclipse.jetty:jetty-ethereum` and 1 more: affected `>=12.1.0, <=12.1.12`, fixed in `12.1.13` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Unauthenticated Remote Input Injection in QNAP HD Station's remotepad](https://agentprime.io/advisories/CVE-2026-39997.md)
  `CVE-2026-39997` · CVE record: QNAP Systems Inc. HybridDesk Station · CVSS 8.9 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer](https://agentprime.io/advisories/CVE-2026-34006.md)
  `CVE-2026-34006` · CVE record: QNAP Systems Inc. sMedio DTCP MOVE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability](https://agentprime.io/advisories/CVE-2026-76659.md)
  `CVE-2026-76659` · CVE record: Hewlett Packard Enterprise HPE NonStop TCP/IP UTILITIES · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability](https://agentprime.io/advisories/CVE-2026-76656.md)
  `CVE-2026-76656` · CVE record: Hewlett Packard Enterprise HPE NonStop TCP/IP UTILITIES · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers](https://agentprime.io/advisories/CVE-2026-110863.md)
  `CVE-2026-110863` · CVE record: better-auth sso · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution](https://agentprime.io/advisories/CVE-2026-110852.md)
  `CVE-2026-110852` · CVE record: n8n-io n8n · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass](https://agentprime.io/advisories/CVE-2026-110838.md)
  `CVE-2026-110838` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php](https://agentprime.io/advisories/CVE-2026-104110.md)
  `CVE-2026-104110` · CVE record: error311 FileRise · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [FileRise OIDC login can bind an attacker identity to an existing local account](https://agentprime.io/advisories/CVE-2026-104108.md)
  `CVE-2026-104108` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-345
- [FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts](https://agentprime.io/advisories/CVE-2026-103977.md)
  `CVE-2026-103977` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-841
- [FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)](https://agentprime.io/advisories/CVE-2026-104105.md)
  `CVE-2026-104105` · CVE record: error311 FileRise · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification](https://agentprime.io/advisories/CVE-2026-104106.md)
  `CVE-2026-104106` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-620
- [FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying](https://agentprime.io/advisories/CVE-2026-69193.md)
  `CVE-2026-69193` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: Login Method Restriction Bypass via Direct API Access](https://agentprime.io/advisories/CVE-2026-69191.md)
  `CVE-2026-69191` · CVE record: error311 FileRise · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: Missing Authentication Guard on File Snippet Preview Endpoint](https://agentprime.io/advisories/CVE-2026-64856.md)
  `CVE-2026-64856` · CVE record: error311 FileRise · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [FileRise: Remember-me auto-login uses stale admin role from token instead of current role](https://agentprime.io/advisories/CVE-2026-57493.md)
  `CVE-2026-57493` · CVE record: error311 FileRise · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation](https://agentprime.io/advisories/CVE-2026-57492.md)
  `CVE-2026-57492` · CVE record: error311 FileRise · CVSS 7.4 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass](https://agentprime.io/advisories/CVE-2026-57489.md)
  `CVE-2026-57489` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [OpenAEV has unauthenticated access and missing object-level authorization on player lessons API](https://agentprime.io/advisories/CVE-2026-71854.md)
  `CVE-2026-71854` · CVE record: OpenAEV-Platform openaev · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, Broken access control
- [WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php](https://agentprime.io/advisories/CVE-2026-55682.md)
  `CVE-2026-55682` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [cemtan sar2html sar2html.py deleteAll missing authentication](https://agentprime.io/advisories/CVE-2026-110669.md)
  `CVE-2026-110669` · CVE record: cemtan sar2html · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Sentry: Improper authentication on SAML SSO process allows user identity linking](https://agentprime.io/advisories/CVE-2026-102899.md)
  `CVE-2026-102899` · CVE record: getsentry sentry · CVSS 7.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force](https://agentprime.io/advisories/CVE-2026-110770.md)
  `CVE-2026-110770` · CVE record: databasus databasus · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist](https://agentprime.io/advisories/CVE-2026-110768.md)
  `CVE-2026-110768` · CVE record: holaboss-ai holaOS · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Improper Authentication in Multiple TP-Link WiFi Repeaters](https://agentprime.io/advisories/CVE-2026-109506.md)
  `CVE-2026-109506` · CVE record: TP-Link Systems Inc. RE190 v5 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTE0VDE4OjMxOjM3LjIyODAwMFoiLCJDVkUtMjAyNi0xMDk1MDYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjAxLjQ1ODAwMFoiLCJDVkUtMjAyNi0xMTE2MjYiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjAxLjQ1ODAwMFoiLCJDVkUtMjAyNi0xMTE2MjYiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.