# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Missing authentication in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-60432.md)
  `CVE-2026-60432` · CVE record: Oracle Corporation Oracle Solaris · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Product Workbench](https://agentprime.io/advisories/CVE-2026-101808.md)
  `CVE-2026-101808` · CVE record: Oracle Corporation Oracle Product Workbench · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Application Object Library](https://agentprime.io/advisories/CVE-2026-101767.md)
  `CVE-2026-101767` · CVE record: Oracle Corporation Oracle Application Object Library · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Communications Billing and Revenue Management](https://agentprime.io/advisories/CVE-2026-101765.md)
  `CVE-2026-101765` · CVE record: Oracle Corporation Oracle Communications Billing and Revenue Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Communications BRM - Elastic Charging Engine](https://agentprime.io/advisories/CVE-2026-101763.md)
  `CVE-2026-101763` · CVE record: Oracle Corporation Oracle Communications BRM - Elastic Charging Engine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Communications Billing and Revenue Management](https://agentprime.io/advisories/CVE-2026-101606.md)
  `CVE-2026-101606` · CVE record: Oracle Corporation Oracle Communications Billing and Revenue Management · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-101590.md)
  `CVE-2026-101590` · CVE record: Oracle Corporation Helidon · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-101574.md)
  `CVE-2026-101574` · CVE record: Oracle Corporation Helidon · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation, Authentication bypass, Cross-site request forgery (CSRF)
- [Missing authentication in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-101537.md)
  `CVE-2026-101537` · CVE record: Oracle Corporation Oracle Solaris · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle EDI Gateway](https://agentprime.io/advisories/CVE-2026-101532.md)
  `CVE-2026-101532` · CVE record: Oracle Corporation Oracle EDI Gateway · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass
- [Missing authentication in Oracle Corporation Oracle APEX](https://agentprime.io/advisories/CVE-2026-101521.md)
  `CVE-2026-101521` · CVE record: Oracle Corporation Oracle APEX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle EDI Gateway](https://agentprime.io/advisories/CVE-2026-101519.md)
  `CVE-2026-101519` · CVE record: Oracle Corporation Oracle EDI Gateway · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebCenter Sites](https://agentprime.io/advisories/CVE-2026-101499.md)
  `CVE-2026-101499` · CVE record: Oracle Corporation Oracle WebCenter Sites · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101490.md)
  `CVE-2026-101490` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Secure Backup](https://agentprime.io/advisories/CVE-2026-101484.md)
  `CVE-2026-101484` · CVE record: Oracle Corporation Oracle Secure Backup · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-101473.md)
  `CVE-2026-101473` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Product Lifecycle Analytics](https://agentprime.io/advisories/CVE-2026-101469.md)
  `CVE-2026-101469` · CVE record: Oracle Corporation Oracle Product Lifecycle Analytics · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: SQL injection, Privilege escalation, Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101450.md)
  `CVE-2026-101450` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101441.md)
  `CVE-2026-101441` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101440.md)
  `CVE-2026-101440` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101439.md)
  `CVE-2026-101439` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101438.md)
  `CVE-2026-101438` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 8.0 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101433.md)
  `CVE-2026-101433` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101430.md)
  `CVE-2026-101430` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 6.2 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101421.md)
  `CVE-2026-101421` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101417.md)
  `CVE-2026-101417` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101409.md)
  `CVE-2026-101409` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101406.md)
  `CVE-2026-101406` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101405.md)
  `CVE-2026-101405` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101390.md)
  `CVE-2026-101390` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing](https://agentprime.io/advisories/GHSA-653j-g8j7-gh54.md)
  `GHSA-653j-g8j7-gh54`, `CVE-2026-113710` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting](https://agentprime.io/advisories/CVE-2026-97406.md)
  `CVE-2026-97406` · CVE record: Xerj Console API · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass, Broken access control
- [SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing](https://agentprime.io/advisories/CVE-2026-113703.md)
  `CVE-2026-113703` · CVE record: giuseppe99barchetta SuggestArr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password](https://agentprime.io/advisories/CVE-2026-113682.md)
  `CVE-2026-113682` · CVE record: networknt light-4j · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms](https://agentprime.io/advisories/CVE-2026-101296.md)
  `CVE-2026-101296` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints](https://agentprime.io/advisories/CVE-2026-105949.md)
  `CVE-2026-105949` · CVE record: Red Hat streams for Apache Kafka 2 and 1 more · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes](https://agentprime.io/advisories/CVE-2026-113358.md)
  `CVE-2026-113358` · CVE record: lavalite cms · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Unlimited authentication attempts in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43847.md)
  `CVE-2026-43847` · CVE record: Advantech ADAM-3600 · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43844.md)
  `CVE-2026-43844` · CVE record: Advantech ADAM-3600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper Signature Verification of Active Update Files](https://agentprime.io/advisories/CVE-2026-113469.md)
  `CVE-2026-113469` · CVE record: Stormshield Stormshield Network Security · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery](https://agentprime.io/advisories/CVE-2024-2323.md)
  `CVE-2024-2323` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper Signature Verification of Firmware Update Files](https://agentprime.io/advisories/CVE-2026-111090.md)
  `CVE-2026-111090` · CVE record: Stormshield Stormshield Network Security · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in ASUS Router](https://agentprime.io/advisories/CVE-2026-75753.md)
  `CVE-2026-75753` · CVE record: ASUS Router · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in Apple macOS](https://agentprime.io/advisories/CVE-2026-86868.md)
  `CVE-2026-86868` · CVE record: Apple macOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-84490.md)
  `CVE-2026-84490` · CVE record: Apple iOS and iPadOS · CVSS 2.0 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent](https://agentprime.io/advisories/CVE-2026-77932.md)
  `CVE-2026-77932` · CVE record: eosphoros-ai DB-GPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint](https://agentprime.io/advisories/CVE-2026-75128.md)
  `CVE-2026-75128` · CVE record: chatchat-space Langchain-Chatchat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell](https://agentprime.io/advisories/CVE-2026-109442.md)
  `CVE-2026-109442` · CVE record: cas-bigdatalab piflow · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication](https://agentprime.io/advisories/CVE-2026-107400.md)
  `CVE-2026-107400` · CVE record: IBM TRIRIGA Application Platform · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [TS4500 Tape Library Insufficient Session Expiration](https://agentprime.io/advisories/CVE-2025-36069.md)
  `CVE-2025-36069` · CVE record: IBM Storage TS4500 Library · CVSS 5.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [TS4500 Tape Library Insufficient Session Expiration](https://agentprime.io/advisories/CVE-2025-36252.md)
  `CVE-2025-36252` · CVE record: IBM Storage TS4500 Library · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210](https://agentprime.io/advisories/CVE-2026-105815.md)
  `CVE-2026-105815` · CVE record: TP-Link Systems Inc. Tapo C210 v3.6 · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210](https://agentprime.io/advisories/CVE-2026-105814.md)
  `CVE-2026-105814` · CVE record: TP-Link Systems Inc. Tapo C210 v3.6 · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Dell Application Store](https://agentprime.io/advisories/CVE-2026-82166.md)
  `CVE-2026-82166` · CVE record: Dell Application Store · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password](https://agentprime.io/advisories/CVE-2026-112775.md)
  `CVE-2026-112775` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend](https://agentprime.io/advisories/CVE-2026-109437.md)
  `CVE-2026-109437` · CVE record: CognicellAI Cognition · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination](https://agentprime.io/advisories/CVE-2025-13173.md)
  `CVE-2025-13173` · CVE record: WSO2 WSO2 API Control Plane and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse](https://agentprime.io/advisories/CVE-2026-107186.md)
  `CVE-2026-107186` · CVE record: Eptura Archibus · CVSS 8.6 High · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint](https://agentprime.io/advisories/CVE-2026-111056.md)
  `CVE-2026-111056` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, CWE-204
- [Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue](https://agentprime.io/advisories/CVE-2026-12254.md)
  `CVE-2026-12254` · CVE record: Netskope Inc. Netskope Client · CVSS 6.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTE5VDE1OjM3OjExLjQyMzAwMFoiLCJDVkUtMjAyNi0xMjI1NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTIwVDIxOjIzOjQ1LjA4NTAwMFoiLCJDVkUtMjAyNi04MzM5NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTIwVDIxOjIzOjQ1LjA4NTAwMFoiLCJDVkUtMjAyNi04MzM5NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.