# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket](https://agentprime.io/advisories/CVE-2026-109289.md)
  `CVE-2026-109289` · CVE record: open-webui open-webui · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Improper OAuth token validation in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-85958.md)
  `CVE-2026-85958` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields](https://agentprime.io/advisories/CVE-2026-92681.md)
  `CVE-2026-92681` · CVE record: Neo4j @neo4j/graphql · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller](https://agentprime.io/advisories/CVE-2026-93693.md)
  `CVE-2026-93693` · CVE record: Progress ShareFile Storage Zones Controller · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF), CWE-20, CWE-116
- [agno-agi agno auth.py get_authentication_dependency missing authentication](https://agentprime.io/advisories/CVE-2026-108818.md)
  `CVE-2026-108818` · CVE record: agno-agi agno · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication](https://agentprime.io/advisories/CVE-2026-93582.md)
  `CVE-2026-93582` · CVE record: OTRS GmbH (former OTRS AG) OTRS and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Insufficient Session Revocation for JWT Authentication](https://agentprime.io/advisories/CVE-2026-78357.md)
  `CVE-2026-78357` · CVE record: OTRS GmbH (former OTRS AG) OTRS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Eleveo Call Recording Software logout session expiration](https://agentprime.io/advisories/CVE-2026-108809.md)
  `CVE-2026-108809` · CVE record: Eleveo Call Recording Software · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients](https://agentprime.io/advisories/CVE-2026-109082.md)
  `CVE-2026-109082` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [y_project RuoYi Disable API add changeStatus session expiration](https://agentprime.io/advisories/CVE-2026-108803.md)
  `CVE-2026-108803` · CVE record: y_project RuoYi · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in Samsung Mobile Samsung Flow](https://agentprime.io/advisories/CVE-2026-21134.md)
  `CVE-2026-21134` · CVE record: Samsung Mobile Samsung Flow · CVSS 6.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration](https://agentprime.io/advisories/CVE-2026-108785.md)
  `CVE-2026-108785` · CVE record: macrozheng mall · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass
- [AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize](https://agentprime.io/advisories/CVE-2026-108865.md)
  `CVE-2026-108865` · CVE record: AmoyLab Unla · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface](https://agentprime.io/advisories/CVE-2026-108863.md)
  `CVE-2026-108863` · CVE record: Katanemo Plano · CVSS 8.7 High · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send](https://agentprime.io/advisories/CVE-2026-108757.md)
  `CVE-2026-108757` · CVE record: Nexting pinclaw · CVSS 7.1 High · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces](https://agentprime.io/advisories/CVE-2026-108739.md)
  `CVE-2026-108739` · CVE record: openagents-org OpenAgents · CVSS 8.7 High · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords](https://agentprime.io/advisories/CVE-2026-88827.md)
  `CVE-2026-88827` · CVE record: Unknown Disable Users · CVSS 8.8 High · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter](https://agentprime.io/advisories/CVE-2026-84737.md)
  `CVE-2026-84737` · CVE record: Unknown Freeton WP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter](https://agentprime.io/advisories/CVE-2026-84734.md)
  `CVE-2026-84734` · CVE record: Unknown Mindstien Quick Login · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [Studio-Saelix Sencho Login Endpoint login improper authentication](https://agentprime.io/advisories/CVE-2026-108522.md)
  `CVE-2026-108522` · CVE record: Studio-Saelix Sencho · CVSS 6.9 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect](https://agentprime.io/advisories/CVE-2026-108707.md)
  `CVE-2026-108707` · CVE record: WuKongOpenSource Wukong_HRM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Oct 2026 · Tags: Authentication bypass
- [WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-62038.md)
  `CVE-2026-62038` · CVE record: DigitalME eRoom · CVSS 7.3 High · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login](https://agentprime.io/advisories/CVE-2026-108580.md)
  `CVE-2026-108580` · CVE record: phoenixthrush AniWorld Downloader · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing](https://agentprime.io/advisories/CVE-2026-108549.md)
  `CVE-2026-108549` · CVE record: chenhg5 cc-connect · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token](https://agentprime.io/advisories/CVE-2026-108548.md)
  `CVE-2026-108548` · CVE record: iflytek astron-rpa · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL](https://agentprime.io/advisories/CVE-2026-108163.md)
  `CVE-2026-108163` · CVE record: smp46 pingvin-share-x · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification](https://agentprime.io/advisories/CVE-2026-104759.md)
  `CVE-2026-104759` · CVE record: wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback](https://agentprime.io/advisories/CVE-2026-104803.md)
  `CVE-2026-104803` · CVE record: whyun WPCOM Member · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-93949.md)
  `CVE-2026-93949` · CVE record: Omegathemes Grocery Shopping Store · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP](https://agentprime.io/advisories/CVE-2026-94256.md)
  `CVE-2026-94256` · CVE record: Unknown SMS Alert · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN](https://agentprime.io/advisories/CVE-2026-107120.md)
  `CVE-2026-107120` · CVE record: Unknown Contest Gallery · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler](https://agentprime.io/advisories/CVE-2026-104732.md)
  `CVE-2026-104732` · CVE record: inilerm Advanced IP Blocker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field A…](https://agentprime.io/advisories/CVE-2026-104797.md)
  `CVE-2026-104797` · CVE record: nasirahmed Advanced Form Integration — Connect Forms to 300+ Apps · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed](https://agentprime.io/advisories/GHSA-hjx8-qv73-f7cm.md)
  `GHSA-hjx8-qv73-f7cm`, `CVE-2026-111919`, `GO-2026-6733` · Go `code.vikunja.io/api`: affected `>=0.22.0, <=2.6.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes](https://agentprime.io/advisories/GHSA-4hv6-xc92-j86g.md)
  `GHSA-4hv6-xc92-j86g`, `CVE-2026-111917`, `GO-2026-6715` · Go `code.vikunja.io/api`: affected `>=2.3.0, <2.7.0`, fixed in `2.7.0` · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords](https://agentprime.io/advisories/GHSA-m469-88xx-8rx2.md)
  `GHSA-m469-88xx-8rx2`, `CVE-2026-91973`, `GO-2026-6737` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited](https://agentprime.io/advisories/GHSA-6rvj-qwjf-3m4q.md)
  `GHSA-6rvj-qwjf-3m4q`, `CVE-2026-91972`, `GO-2026-6721` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover](https://agentprime.io/advisories/GHSA-xv7q-fvmc-jx96.md)
  `GHSA-xv7q-fvmc-jx96`, `CVE-2026-62367`, `GO-2026-6758` · Go `code.vikunja.io/api`: affected `>=1.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, CWE-345
- [Astron Agent: Unsandboxed code-node leads to cross-tenant RCE](https://agentprime.io/advisories/CVE-2026-108263.md)
  `CVE-2026-108263` · CVE record: iflytek astron-agent · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection, Authentication bypass, Broken access control, CWE-653
- [x64dbg-MCP Server exposes debugger operations to unauthenticated network clients](https://agentprime.io/advisories/CVE-2026-107824.md)
  `CVE-2026-107824` · CVE record: duty1g x64dbg-mcp-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password](https://agentprime.io/advisories/GHSA-68w4-83fh-f2w8.md)
  `GHSA-68w4-83fh-f2w8` · PyPI `pyload-ng`: affected `>=0.5.0b3.dev1, <=0.5.0b3.dev101`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled \`X-Forwarded-For\` Header](https://agentprime.io/advisories/GHSA-9q47-3cm2-2rp8.md)
  `GHSA-9q47-3cm2-2rp8` · PyPI `pyload-ng`: affected `=0.5.0b3.dev101`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session](https://agentprime.io/advisories/GHSA-jq7h-wrvp-3rgx.md)
  `GHSA-jq7h-wrvp-3rgx`, `CVE-2026-123813` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev101`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Api.set_user_permission never invalidates the target's session](https://agentprime.io/advisories/GHSA-889w-m37p-88m5.md)
  `GHSA-889w-m37p-88m5` · PyPI `pyload-ng`: affected `>=0.5.0b3.dev98, <=0.5.0b3.dev101`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)](https://agentprime.io/advisories/GHSA-45gv-9wjv-xh7p.md)
  `GHSA-45gv-9wjv-xh7p`, `CVE-2026-107808`, `GO-2026-6704` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814`, fixed in `1.9.10-0.20260728074558-95cd21b70814` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, CWE-305, CWE-308
- [pyLoad has an authentication bypass in API key validation (check_apikey cache)](https://agentprime.io/advisories/GHSA-r44w-v6gf-x3p6.md)
  `GHSA-r44w-v6gf-x3p6`, `CVE-2026-123816` · PyPI `pyload-ng`: affected `<0.5.0b3.dev101`, fixed in `0.5.0b3.dev101` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Unauthenticated access to /web/\<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo](https://agentprime.io/advisories/GHSA-j92p-c242-7hfx.md)
  `GHSA-j92p-c242-7hfx`, `CVE-2026-75597`, `PYSEC-2026-4292` · PyPI `pyload-ng`: affected `<0.5.0b3.dev101`, fixed in `0.5.0b3.dev101` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking](https://agentprime.io/advisories/CVE-2026-108157.md)
  `CVE-2026-108157` · CVE record: smp46 pingvin-share-x · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token](https://agentprime.io/advisories/CVE-2026-104084.md)
  `CVE-2026-104084` · CVE record: Smartertools Smartermail · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel](https://agentprime.io/advisories/CVE-2026-33272.md)
  `CVE-2026-33272` · CVE record: Red Lion Controls 700 Series · CVSS 6.8 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-33367.md)
  `CVE-2026-33367` · CVE record: Red Lion Controls 700 Series · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code](https://agentprime.io/advisories/CVE-2026-108109.md)
  `CVE-2026-108109` · CVE record: hotspotbilling phpnuxbill · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()](https://agentprime.io/advisories/CVE-2026-108108.md)
  `CVE-2026-108108` · CVE record: hotspotbilling phpnuxbill · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-85479.md)
  `CVE-2026-85479` · CVE record: Grid Protection Alliance openPDC and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-105281.md)
  `CVE-2026-105281` · CVE record: Grid Protection Alliance openPDC and 2 more · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-106601.md)
  `CVE-2026-106601` · CVE record: Automattic Jetpack · CVSS 5.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-106602.md)
  `CVE-2026-106602` · CVE record: Automattic Jetpack · CVSS 4.8 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter](https://agentprime.io/advisories/CVE-2026-71575.md)
  `CVE-2026-71575` · CVE record: Apache Software Foundation Apache CXF · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability](https://agentprime.io/advisories/CVE-2026-96333.md)
  `CVE-2026-96333` · CVE record: Liquid Web / StellarWP GiveWP · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability](https://agentprime.io/advisories/CVE-2026-96336.md)
  `CVE-2026-96336` · CVE record: WPMU DEV Forminator · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTA5VDEwOjAwOjE1LjE5MDAwMFoiLCJDVkUtMjAyNi05NjMzNiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTEyVDE2OjA1OjA3LjYwNTAwMFoiLCJDVkUtMjAyNi0xMDkzMTIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTEyVDE2OjA1OjA3LjYwNTAwMFoiLCJDVkUtMjAyNi0xMDkzMTIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.