# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [BillaBear Installation InstallController.php processInstall missing authentication](https://agentprime.io/advisories/CVE-2026-116257.md)
  `CVE-2026-116257` · CVE record: BillaBear · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [Implem Inc. Pleasanter: Pleasanter provided fails to properly verify passwords in LDAP authentication when…](https://agentprime.io/advisories/CVE-2026-113438.md)
  `CVE-2026-113438` · CVE record: Implem Inc. Pleasanter · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry](https://agentprime.io/advisories/CVE-2026-95663.md)
  `CVE-2026-95663` · CVE record: Apache Software Foundation Apache Camel · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication](https://agentprime.io/advisories/CVE-2026-116228.md)
  `CVE-2026-116228` · CVE record: 777genius agent-teams-ai · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret](https://agentprime.io/advisories/CVE-2026-103299.md)
  `CVE-2026-103299` · CVE record: Unknown Payment Gateway · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key](https://agentprime.io/advisories/CVE-2026-103319.md)
  `CVE-2026-103319` · CVE record: Unknown OPay Payment Gateway for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback](https://agentprime.io/advisories/CVE-2026-103306.md)
  `CVE-2026-103306` · CVE record: Unknown Online Payments with iK Pay Gateway · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [NocoDB signup validatePassword excessive authentication](https://agentprime.io/advisories/CVE-2026-116123.md)
  `CVE-2026-116123` · CVE record: NocoDB · CVSS 6.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass, CWE-799
- [GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication](https://agentprime.io/advisories/CVE-2026-116110.md)
  `CVE-2026-116110` · CVE record: GiantappMan LiveWallPaper · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords.](https://agentprime.io/advisories/CVE-2026-116638.md)
  `CVE-2026-116638` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition](https://agentprime.io/advisories/CVE-2026-116201.md)
  `CVE-2026-116201` · CVE record: grokability snipe-it · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass
- [Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses](https://agentprime.io/advisories/CVE-2026-116163.md)
  `CVE-2026-116163` · CVE record: parse-community parse-server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass
- [Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config](https://agentprime.io/advisories/CVE-2026-116070.md)
  `CVE-2026-116070` · CVE record: dqzboy Docker-Proxy · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass
- [WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret](https://agentprime.io/advisories/CVE-2026-110285.md)
  `CVE-2026-110285` · CVE record: Unknown WP Stripe Checkout · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass
- [YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication](https://agentprime.io/advisories/CVE-2026-116007.md)
  `CVE-2026-116007` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass, CWE-799
- [YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication](https://agentprime.io/advisories/CVE-2026-116006.md)
  `CVE-2026-116006` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass
- [Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation](https://agentprime.io/advisories/CVE-2026-115996.md)
  `CVE-2026-115996` · CVE record: Unitree Robotics Unitree Go2 · CVSS 6.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Forged signed tokens let any registered user take over other users and organizations](https://agentprime.io/advisories/CVE-2026-115933.md)
  `CVE-2026-115933` · CVE record: GitroomHQ postiz-app · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation](https://agentprime.io/advisories/CVE-2026-110956.md)
  `CVE-2026-110956` · CVE record: Unknown asVereinbase · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Authentication bypass
- [Laravel TokenGuard authentication bypass through non-string API credentials](https://agentprime.io/advisories/GHSA-f9x3-7vq9-cph6.md)
  `GHSA-f9x3-7vq9-cph6`, `CVE-2026-114509`, `PKSA-b41t-wbzk-9q51` · Packagist `laravel/framework`: affected `<12.68.0 || >=13.0.0, <13.29.0`, fixed in `12.68.0`, `13.29.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-1287
- [FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server](https://agentprime.io/advisories/GHSA-vqqp-x5qm-5qp4.md)
  `GHSA-vqqp-x5qm-5qp4` · PyPI `fastmcp` and 1 more: affected `>=4.0.0a1, <4.1.2`, fixed in `4.1.2` · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants](https://agentprime.io/advisories/CVE-2026-65825.md)
  `CVE-2026-65825` · CVE record: open-reception appointment-booking-software · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie](https://agentprime.io/advisories/CVE-2026-65824.md)
  `CVE-2026-65824` · CVE record: open-reception appointment-booking-software · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr](https://agentprime.io/advisories/CVE-2026-79977.md)
  `CVE-2026-79977` · CVE record: zephyrproject zephyr · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-346
- [SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream](https://agentprime.io/advisories/GHSA-c8w8-3pqp-wr83.md)
  `GHSA-c8w8-3pqp-wr83`, `CVE-2026-73054`, `GO-2026-6831` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260731131820-67bc300b6ea6`, fixed in `0.0.0-20260731131820-67bc300b6ea6` · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation](https://agentprime.io/advisories/CVE-2026-55463.md)
  `CVE-2026-55463` · CVE record: intranda goobi-viewer-core · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-1385
- [Goobi viewer: OpenID JWT audience not enforced by the verifier](https://agentprime.io/advisories/CVE-2026-55459.md)
  `CVE-2026-55459` · CVE record: intranda goobi-viewer-core · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-345
- [Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass](https://agentprime.io/advisories/CVE-2026-55457.md)
  `CVE-2026-55457` · CVE record: intranda goobi-viewer-core · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-1392
- [Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer](https://agentprime.io/advisories/CVE-2026-46651.md)
  `CVE-2026-46651` · CVE record: intranda goobi-viewer-core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Information disclosure, Server-side request forgery (SSRF)
- [NetBox MCP Server: HTTP transport exposes all NetBox data without authentication](https://agentprime.io/advisories/CVE-2026-57207.md)
  `CVE-2026-57207` · CVE record: netboxlabs netbox-mcp-server · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-1059
- [DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)](https://agentprime.io/advisories/CVE-2026-114357.md)
  `CVE-2026-114357` · CVE record: DJI CrystalSky ZS600C · CVSS 7.0 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity](https://agentprime.io/advisories/CVE-2026-93629.md)
  `CVE-2026-93629` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response](https://agentprime.io/advisories/CVE-2026-93628.md)
  `CVE-2026-93628` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer](https://agentprime.io/advisories/CVE-2026-93627.md)
  `CVE-2026-93627` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Missing Authentication in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30053.md)
  `CVE-2025-30053` · CVE record: CGM CGM CLININET · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass via IP Spoofing in CGM CLININET rsyncd](https://agentprime.io/advisories/CVE-2025-30052.md)
  `CVE-2025-30052` · CVE record: CGM CGM CLININET · CVSS 8.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Missing Authentication in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30043.md)
  `CVE-2025-30043` · CVE record: CGM CGM CLININET · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-63244.md)
  `CVE-2026-63244` · CVE record: WizLearn Technologies Pte. Ltd. Learning Management System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in ASUS Router](https://agentprime.io/advisories/CVE-2026-93489.md)
  `CVE-2026-93489` · CVE record: ASUS Router · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Firmware verification vulnerability](https://agentprime.io/advisories/CVE-2026-63243.md)
  `CVE-2026-63243` · CVE record: Creative Labs Creative Sound Blaster Katana V2, V2X, SE · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server](https://agentprime.io/advisories/CVE-2026-107858.md)
  `CVE-2026-107858` · CVE record: Google Agent Development Kit (ADK) for Java · CVSS 7.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-942, CWE-1385
- [Authentication Source Verification Issue in Okta Access Gateway](https://agentprime.io/advisories/CVE-2026-115546.md)
  `CVE-2026-115546` · CVE record: Okta Okta Access Gateway · CVSS 8.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Authentication Bypass Leading to Server-Side Command Execution](https://agentprime.io/advisories/CVE-2026-19677.md)
  `CVE-2026-19677` · CVE record: onPhase onPhase Forms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Kiloview E3 NDI Encoder Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-110825.md)
  `CVE-2026-110825` · CVE record: Kiloview E3 Firmware · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Kiloview E3 NDI Encoder Insufficient Session Expiration](https://agentprime.io/advisories/CVE-2026-96616.md)
  `CVE-2026-96616` · CVE record: Kiloview E3 Firmware · CVSS 8.3 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Kiloview E3 NDI Encoder Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-111100.md)
  `CVE-2026-111100` · CVE record: Kiloview E3 Firmware · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83938.md)
  `CVE-2026-83938` · CVE record: Microsoft Azure Kubernetes Configuration Service · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [AAD App Proxy Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-97785.md)
  `CVE-2026-97785` · CVE record: Microsoft Microsoft Entra application proxy · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass](https://agentprime.io/advisories/CVE-2026-115362.md)
  `CVE-2026-115362` · CVE record: openbao openbao · CVSS 2.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation](https://agentprime.io/advisories/CVE-2026-115356.md)
  `CVE-2026-115356` · CVE record: openbao openbao · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8](https://agentprime.io/advisories/CVE-2026-95718.md)
  `CVE-2026-95718` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)](https://agentprime.io/advisories/CVE-2026-79887.md)
  `CVE-2026-79887` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 8.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Code injection, Authentication bypass
- [Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8](https://agentprime.io/advisories/CVE-2026-79885.md)
  `CVE-2026-79885` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 8.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass leads to Sensitive Information Disclosure in AOS-8](https://agentprime.io/advisories/CVE-2026-79884.md)
  `CVE-2026-79884` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 8.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Leading to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79881.md)
  `CVE-2026-79881` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 8.5 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-79875.md)
  `CVE-2026-79875` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass in the API allows Administrative Access of AOS-10](https://agentprime.io/advisories/CVE-2026-79874.md)
  `CVE-2026-79874` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-79873.md)
  `CVE-2026-79873` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass leads to Unauthorized Access in AOS-8](https://agentprime.io/advisories/CVE-2026-79870.md)
  `CVE-2026-79870` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Leading to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79869.md)
  `CVE-2026-79869` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjMwLjI5OTAwMFoiLCJDVkUtMjAyNi03OTg2OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTI2VDEwOjQxOjAxLjA4ODAwMFoiLCJDVkUtMjAyNi04OTIwOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTI2VDEwOjQxOjAxLjA4ODAwMFoiLCJDVkUtMjAyNi04OTIwOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.