# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8](https://agentprime.io/advisories/CVE-2026-79868.md)
  `CVE-2026-79868` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Leading to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79867.md)
  `CVE-2026-79867` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise](https://agentprime.io/advisories/CVE-2026-79855.md)
  `CVE-2026-79855` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Leading to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79850.md)
  `CVE-2026-79850` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Leading to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79844.md)
  `CVE-2026-79844` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB](https://agentprime.io/advisories/CVE-2026-13599.md)
  `CVE-2026-13599` · CVE record: ABB Ability Edgenius · CVSS 5.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization](https://agentprime.io/advisories/CVE-2026-54238.md)
  `CVE-2026-54238` · CVE record: supabase realtime · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Storybook dev server vulnerable to code injection from the local network](https://agentprime.io/advisories/GHSA-px85-f4q5-jh77.md)
  `GHSA-px85-f4q5-jh77`, `CVE-2026-114126` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal, Code injection, Authentication bypass, CWE-1188
- [Django REST framework: TokenProxy.delete() reports success and revokes nothing](https://agentprime.io/advisories/GHSA-xw6w-gcfp-cf8m.md)
  `GHSA-xw6w-gcfp-cf8m`, `CVE-2026-114137` · PyPI `djangorestframework`: affected `>=3.12.0, <3.18.2`, fixed in `3.18.2` · CVSS 7.4 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass, CWE-390
- [Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix](https://agentprime.io/advisories/CVE-2026-115333.md)
  `CVE-2026-115333` · CVE record: uselotus lotus · CVSS 8.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-112241.md)
  `CVE-2026-112241` · CVE record: Brainstorm Force SureCart · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token](https://agentprime.io/advisories/CVE-2026-111958.md)
  `CVE-2026-111958` · CVE record: Unknown Royal MCP · CVSS 7.5 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [NewType Infortech｜NT OneAPP - Authentication Bypass](https://agentprime.io/advisories/CVE-2026-114222.md)
  `CVE-2026-114222` · CVE record: NewType Infortech NT OneAPP · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-114732.md)
  `CVE-2026-114732` · CVE record: Roundcube Webmail · CVSS 6.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router](https://agentprime.io/advisories/CVE-2026-114640.md)
  `CVE-2026-114640` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool](https://agentprime.io/advisories/CVE-2026-114639.md)
  `CVE-2026-114639` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision](https://agentprime.io/advisories/CVE-2026-114638.md)
  `CVE-2026-114638` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router](https://agentprime.io/advisories/CVE-2026-114636.md)
  `CVE-2026-114636` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme](https://agentprime.io/advisories/CVE-2026-114635.md)
  `CVE-2026-114635` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124](https://agentprime.io/advisories/CVE-2026-84923.md)
  `CVE-2026-84923` · CVE record: Drupal Email Verification / SMS Verification / OTP Verification · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150](https://agentprime.io/advisories/CVE-2026-87952.md)
  `CVE-2026-87952` · CVE record: Drupal SAML SSO - Service Provider · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182](https://agentprime.io/advisories/CVE-2026-96385.md)
  `CVE-2026-96385` · CVE record: Drupal REST & JSON API Authentication for Drupal · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183](https://agentprime.io/advisories/CVE-2026-96387.md)
  `CVE-2026-96387` · CVE record: Drupal Stop administrator login · CVSS 3.8 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-103090.md)
  `CVE-2026-103090` · CVE record: Google SAM · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [oretnom23 php-travel-agency-system Session session.php missing authentication](https://agentprime.io/advisories/CVE-2026-114439.md)
  `CVE-2026-114439` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [CVE-2026-82987](https://agentprime.io/advisories/CVE-2026-82987.md)
  `CVE-2026-82987` · CVE record: Viewsonic vCast · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Vitest: Code injection via unauthenticated manual mock registration](https://agentprime.io/advisories/GHSA-qxg6-89mg-rqv8.md)
  `GHSA-qxg6-89mg-rqv8`, `CVE-2026-112949` · npm `@vitest/mocker`: affected `>=2.1.0-beta.7, <4.1.12 || >=5.0.0-beta.1, <5.0.3`, fixed in `4.1.12`, `5.0.3` · CVSS 4.7 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Code injection, Authentication bypass, CWE-116
- [Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering](https://agentprime.io/advisories/CVE-2026-114438.md)
  `CVE-2026-114438` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication](https://agentprime.io/advisories/CVE-2026-111811.md)
  `CVE-2026-111811` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life](https://agentprime.io/advisories/CVE-2026-105944.md)
  `CVE-2026-105944` · CVE record: Apache Software Foundation Apache Pulsar Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass](https://agentprime.io/advisories/CVE-2026-89035.md)
  `CVE-2026-89035` · CVE record: MikroTik RouterOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [ApostropheCMS: Missing Authentication in \`cleanExport\` Route](https://agentprime.io/advisories/GHSA-rw26-wwfc-9wvm.md)
  `GHSA-rw26-wwfc-9wvm`, `CVE-2026-113648` · npm `@apostrophecms/import-export`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 3.1 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass, Broken access control
- [MomoTommy file-management-system Files API FileController.php destroy missing authentication](https://agentprime.io/advisories/CVE-2026-114261.md)
  `CVE-2026-114261` · CVE record: MomoTommy file-management-system · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet](https://agentprime.io/advisories/CVE-2026-114123.md)
  `CVE-2026-114123` · CVE record: dynamics365ninja d365fo-mcp-server · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication](https://agentprime.io/advisories/CVE-2026-114260.md)
  `CVE-2026-114260` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76524.md)
  `CVE-2026-76524` · CVE record: Cisco Cisco Open Source Snort3 · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76474.md)
  `CVE-2026-76474` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access](https://agentprime.io/advisories/CVE-2025-0326.md)
  `CVE-2025-0326` · CVE record: WSO2 WSO2 Identity Server and 1 more · CVSS 7.4 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks](https://agentprime.io/advisories/CVE-2024-5563.md)
  `CVE-2024-5563` · CVE record: WSO2 WSO2 Identity Server · CVSS 4.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication](https://agentprime.io/advisories/CVE-2026-114248.md)
  `CVE-2026-114248` · CVE record: dhikshitha29 Insurance-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth](https://agentprime.io/advisories/CVE-2026-86249.md)
  `CVE-2026-86249` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache bRPC: Missing Authentication for Streaming RPC Frames](https://agentprime.io/advisories/CVE-2026-78334.md)
  `CVE-2026-78334` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests](https://agentprime.io/advisories/CVE-2026-48830.md)
  `CVE-2026-48830` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC](https://agentprime.io/advisories/CVE-2026-59562.md)
  `CVE-2026-59562` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache IoTDB: Auth Bypass in pipeTransfer() interface](https://agentprime.io/advisories/CVE-2026-58663.md)
  `CVE-2026-58663` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity](https://agentprime.io/advisories/CVE-2026-107447.md)
  `CVE-2026-107447` · CVE record: Unknown Contest Gallery · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token](https://agentprime.io/advisories/CVE-2026-96901.md)
  `CVE-2026-96901` · CVE record: Unknown Cart Abandonment Recovery for WooCommerce · CVSS 3.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass](https://agentprime.io/advisories/CVE-2026-111955.md)
  `CVE-2026-111955` · CVE record: Unknown WholesaleX · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding](https://agentprime.io/advisories/CVE-2026-111949.md)
  `CVE-2026-111949` · CVE record: Unknown miniOrange 2FA · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret](https://agentprime.io/advisories/CVE-2026-103302.md)
  `CVE-2026-103302` · CVE record: Unknown Payment Gateway for Idram · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action](https://agentprime.io/advisories/CVE-2026-114092.md)
  `CVE-2026-114092` · CVE record: triggerdotdev trigger.dev · CVSS 8.3 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server](https://agentprime.io/advisories/CVE-2026-114090.md)
  `CVE-2026-114090` · CVE record: trigger.dev cli-v3 · CVSS 7.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API](https://agentprime.io/advisories/CVE-2026-114085.md)
  `CVE-2026-114085` · CVE record: triggerdotdev trigger.dev · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [IBM i Improper Authentication](https://agentprime.io/advisories/CVE-2026-93744.md)
  `CVE-2026-93744` · CVE record: IBM i · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91665.md)
  `CVE-2026-91665` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91625.md)
  `CVE-2026-91625` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91624.md)
  `CVE-2026-91624` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91573.md)
  `CVE-2026-91573` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91546.md)
  `CVE-2026-91546` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91535.md)
  `CVE-2026-91535` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTIwVDIxOjI2OjI2LjAwODAwMFoiLCJDVkUtMjAyNi05MTUzNSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjMwLjI5OTAwMFoiLCJDVkUtMjAyNi03OTg2OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjMwLjI5OTAwMFoiLCJDVkUtMjAyNi03OTg2OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.