# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback](https://agentprime.io/advisories/CVE-2026-110008.md)
  `CVE-2026-110008` · CVE record: @fastify/oauth2 @fastify/oauth2 · CVSS 4.2 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF), Authentication bypass, CWE-459
- [satya-vinay Events-Management-System missing authentication](https://agentprime.io/advisories/CVE-2026-112143.md)
  `CVE-2026-112143` · CVE record: satya-vinay Events-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Stackrox: stackrox: saml response replay allows multiple central authentication tokens](https://agentprime.io/advisories/CVE-2026-103314.md)
  `CVE-2026-103314` · CVE record: Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 and 1 more · CVSS 7.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation](https://agentprime.io/advisories/CVE-2026-112106.md)
  `CVE-2026-112106` · CVE record: TufayelLUS TikTok-Video-Downloader-PHP · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim](https://agentprime.io/advisories/CVE-2026-85301.md)
  `CVE-2026-85301` · CVE record: Apache Software Foundation Apache Camel · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse](https://agentprime.io/advisories/CVE-2026-84181.md)
  `CVE-2026-84181` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation](https://agentprime.io/advisories/CVE-2026-112105.md)
  `CVE-2026-112105` · CVE record: GlitterWare Passy · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors](https://agentprime.io/advisories/CVE-2026-80312.md)
  `CVE-2026-80312` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [eremef bandcamp-player Remote Control Server database.ts missing authentication](https://agentprime.io/advisories/CVE-2026-112104.md)
  `CVE-2026-112104` · CVE record: eremef bandcamp-player · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [f3-factory fatfree-core HTTP Client web.php \_curl certificate validation](https://agentprime.io/advisories/CVE-2026-112103.md)
  `CVE-2026-112103` · CVE record: f3-factory fatfree-core · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Apache Answer: Reaction API authorization bypass for restricted content](https://agentprime.io/advisories/CVE-2026-90910.md)
  `CVE-2026-90910` · CVE record: Apache Software Foundation Apache Answer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Apache Answer: User Center integration does not revoke first-login sessions after central account suspension](https://agentprime.io/advisories/CVE-2026-86589.md)
  `CVE-2026-86589` · CVE record: Apache Software Foundation Apache Answer · CVSS 5.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation](https://agentprime.io/advisories/CVE-2026-79624.md)
  `CVE-2026-79624` · CVE record: Apache Software Foundation Apache Answer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Apache Kylin: unauthenticated broadcast API and polymorphic deserialization](https://agentprime.io/advisories/CVE-2026-108771.md)
  `CVE-2026-108771` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [check_hba_replication 认证与访问控制绕过](https://agentprime.io/advisories/CVE-2026-111438.md)
  `CVE-2026-111438` · CVE record: openGauss-server openGauss-server · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication](https://agentprime.io/advisories/CVE-2026-112044.md)
  `CVE-2026-112044` · CVE record: dotnet eShop · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-103091.md)
  `CVE-2026-103091` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control, CWE-1188
- [Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-102503.md)
  `CVE-2026-102503` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Broken access control
- [diem-project diem Google Analytics Client gapi.class.php certificate validation](https://agentprime.io/advisories/CVE-2026-112037.md)
  `CVE-2026-112037` · CVE record: diem-project diem · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Gitea SSH certificate principal impersonation of other users](https://agentprime.io/advisories/CVE-2026-109553.md)
  `CVE-2026-109553` · CVE record: Gitea Gitea · CVSS 7.5 High · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass
- [Gitea OpenID account linking without session binding](https://agentprime.io/advisories/CVE-2026-104627.md)
  `CVE-2026-104627` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults](https://agentprime.io/advisories/CVE-2026-110024.md)
  `CVE-2026-110024` · CVE record: @fastify/jwt @fastify/jwt · CVSS 6.8 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass
- [Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files](https://agentprime.io/advisories/CVE-2026-112016.md)
  `CVE-2026-112016` · CVE record: Netcore NR256CN · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass
- [Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver](https://agentprime.io/advisories/CVE-2026-111999.md)
  `CVE-2026-111999` · CVE record: vanus-labs vanus · CVSS 8.7 High · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass
- [OpenCATS Career Portal CareersUI.php processLogin excessive authentication](https://agentprime.io/advisories/CVE-2026-111874.md)
  `CVE-2026-111874` · CVE record: OpenCATS · CVSS 6.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass, CWE-799
- [itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication](https://agentprime.io/advisories/CVE-2026-111870.md)
  `CVE-2026-111870` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection](https://agentprime.io/advisories/CVE-2026-111911.md)
  `CVE-2026-111911` · CVE record: thorsten phpMyFAQ · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking](https://agentprime.io/advisories/CVE-2026-111898.md)
  `CVE-2026-111898` · CVE record: thorsten phpMyFAQ · CVSS 7.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username](https://agentprime.io/advisories/CVE-2026-111895.md)
  `CVE-2026-111895` · CVE record: thorsten phpMyFAQ · CVSS 7.6 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints](https://agentprime.io/advisories/CVE-2026-111892.md)
  `CVE-2026-111892` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint](https://agentprime.io/advisories/CVE-2026-111886.md)
  `CVE-2026-111886` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks](https://agentprime.io/advisories/CVE-2026-111882.md)
  `CVE-2026-111882` · CVE record: thorsten phpMyFAQ · CVSS 8.6 High · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter](https://agentprime.io/advisories/CVE-2026-110653.md)
  `CVE-2026-110653` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation](https://agentprime.io/advisories/CVE-2026-49410.md)
  `CVE-2026-49410` · CVE record: tinyhumansai openhuman · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site request forgery (CSRF), Authentication bypass
- [LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport](https://agentprime.io/advisories/GHSA-w5f2-9q9c-ff4h.md)
  `GHSA-w5f2-9q9c-ff4h`, `CVE-2026-105192` · PyPI `lmcache`: affected `>=0.3.9, <0.5.6`, fixed in `0.5.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass, Insecure deserialization
- [Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)](https://agentprime.io/advisories/CVE-2026-108709.md)
  `CVE-2026-108709` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Apache Kylin: Unauthenticated Metastore Cleanup](https://agentprime.io/advisories/CVE-2026-68573.md)
  `CVE-2026-68573` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [IBM i is Affected By An Improper Authentication Vulnerability in SST / DST](https://agentprime.io/advisories/CVE-2026-17488.md)
  `CVE-2026-17488` · CVE record: IBM i · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query](https://agentprime.io/advisories/CVE-2026-111719.md)
  `CVE-2026-111719` · CVE record: roncoo roncoo-pay · CVSS 8.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix](https://agentprime.io/advisories/CVE-2026-111712.md)
  `CVE-2026-111712` · CVE record: Netcore NR256CN · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel](https://agentprime.io/advisories/CVE-2026-111706.md)
  `CVE-2026-111706` · CVE record: vastxie 99AI · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [LangChat through commit 2a6285a Missing Authentication on REST API Controllers](https://agentprime.io/advisories/CVE-2026-111704.md)
  `CVE-2026-111704` · CVE record: LangChat langchat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API](https://agentprime.io/advisories/CVE-2026-111701.md)
  `CVE-2026-111701` · CVE record: OtterMind Nubase · CVSS 8.3 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie](https://agentprime.io/advisories/CVE-2026-111699.md)
  `CVE-2026-111699` · CVE record: niefy wx-api · CVSS 6.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints](https://agentprime.io/advisories/CVE-2026-111694.md)
  `CVE-2026-111694` · CVE record: qiantongtech qKnow · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header](https://agentprime.io/advisories/CVE-2026-111691.md)
  `CVE-2026-111691` · CVE record: wimoor-erp wimoor · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover](https://agentprime.io/advisories/CVE-2026-111675.md)
  `CVE-2026-111675` · CVE record: xiaochong0302 course-tencent-cloud · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints](https://agentprime.io/advisories/CVE-2026-111673.md)
  `CVE-2026-111673` · CVE record: Thecosy IceCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url](https://agentprime.io/advisories/CVE-2026-111664.md)
  `CVE-2026-111664` · CVE record: safing portmaster · CVSS 4.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint](https://agentprime.io/advisories/CVE-2026-111661.md)
  `CVE-2026-111661` · CVE record: wayn111 waynboot-mall · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid](https://agentprime.io/advisories/CVE-2026-111660.md)
  `CVE-2026-111660` · CVE record: wayn111 waynboot-mall · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit](https://agentprime.io/advisories/CVE-2026-111659.md)
  `CVE-2026-111659` · CVE record: wayn111 waynboot-mall · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id](https://agentprime.io/advisories/CVE-2026-111653.md)
  `CVE-2026-111653` · CVE record: 53AI 53AIHub · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API](https://agentprime.io/advisories/CVE-2026-111650.md)
  `CVE-2026-111650` · CVE record: HoshinoSuzumi chronoframe · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes](https://agentprime.io/advisories/CVE-2026-111644.md)
  `CVE-2026-111644` · CVE record: l429609201 misaka_danmu_server · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback](https://agentprime.io/advisories/CVE-2026-111643.md)
  `CVE-2026-111643` · CVE record: l429609201 misaka_danmu_server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints](https://agentprime.io/advisories/CVE-2026-111641.md)
  `CVE-2026-111641` · CVE record: fastapiadmin FastapiAdmin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [bbs-go through 4.4.6 Account Takeover via Google One Tap Login](https://agentprime.io/advisories/CVE-2026-111639.md)
  `CVE-2026-111639` · CVE record: mlogclub bbs-go · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint](https://agentprime.io/advisories/CVE-2026-111637.md)
  `CVE-2026-111637` · CVE record: Blair2004 NexoPOS · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers](https://agentprime.io/advisories/CVE-2026-111626.md)
  `CVE-2026-111626` · CVE record: Webreaper Damselfly · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjAxLjQ1ODAwMFoiLCJDVkUtMjAyNi0xMTE2MjYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTE5VDE1OjM3OjExLjQyMzAwMFoiLCJDVkUtMjAyNi0xMjI1NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTE5VDE1OjM3OjExLjQyMzAwMFoiLCJDVkUtMjAyNi0xMjI1NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.