# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Missing brute-force protection for web interface](https://agentprime.io/advisories/CVE-2026-22114.md)
  `CVE-2026-22114` · CVE record: Delta Electronics Delta UFC500 · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [API permission bypass via logic bug](https://agentprime.io/advisories/CVE-2026-82104.md)
  `CVE-2026-82104` · CVE record: Teltonika Networks RUT and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code](https://agentprime.io/advisories/CVE-2026-114443.md)
  `CVE-2026-114443` · CVE record: Unknown Security Plugin, Firewall & Malware Scanner with Auto Removal · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication](https://agentprime.io/advisories/CVE-2026-118194.md)
  `CVE-2026-118194` · CVE record: cyberlord92 Page and Post Restriction · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197](https://agentprime.io/advisories/CVE-2026-107254.md)
  `CVE-2026-107254` · CVE record: Drupal Authenticator Login Plus (2FA) · CVSS 4.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201](https://agentprime.io/advisories/CVE-2026-107261.md)
  `CVE-2026-107261` · CVE record: Drupal Authenticator Login Plus (2FA) · CVSS 4.2 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237](https://agentprime.io/advisories/CVE-2026-114539.md)
  `CVE-2026-114539` · CVE record: Drupal DocCheck Basic · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248](https://agentprime.io/advisories/CVE-2026-107256.md)
  `CVE-2026-107256` · CVE record: Drupal Shield · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249](https://agentprime.io/advisories/CVE-2026-114572.md)
  `CVE-2026-114572` · CVE record: Drupal Domain Login Restrict · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281](https://agentprime.io/advisories/CVE-2026-118582.md)
  `CVE-2026-118582` · CVE record: Drupal CAPTCHA · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284](https://agentprime.io/advisories/CVE-2026-118572.md)
  `CVE-2026-118572` · CVE record: Drupal OAuth Login - OAuth OIDC SSO · CVSS 4.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287](https://agentprime.io/advisories/CVE-2026-118554.md)
  `CVE-2026-118554` · CVE record: Drupal OpenID Connect Client · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter](https://agentprime.io/advisories/CVE-2026-118959.md)
  `CVE-2026-118959` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [An issue was discovered in Keyfactor EJBCA 9.](https://agentprime.io/advisories/CVE-2025-49602.md)
  `CVE-2025-49602` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Delinea Privilege Manager agent unauthenticated remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-92744.md)
  `CVE-2026-92744` · CVE record: Delinea Privilege Manager · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS, Authentication bypass
- [Keycloak: Attacker can re-enable and take over disabled clients via registration access token](https://agentprime.io/advisories/GHSA-r7rc-c989-86g6.md)
  `GHSA-r7rc-c989-86g6`, `BIT-keycloak-2026-9705`, `CVE-2026-9705` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY](https://agentprime.io/advisories/GHSA-q344-5v34-gm84.md)
  `GHSA-q344-5v34-gm84`, `CVE-2026-62264` · npm `@sylphx/pdf-reader-mcp`: affected `>=2.2.0, <3.0.1`, fixed in `3.0.1` · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow](https://agentprime.io/advisories/GHSA-68wq-phq7-p2vg.md)
  `GHSA-68wq-phq7-p2vg`, `CVE-2026-55186`, `PKSA-xxk3-rjxm-jftv` · Packagist `silverstripe/mfa`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 4.2 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90862.md)
  `CVE-2026-90862` · CVE record: Progress Software WS_FTP Server · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass, CWE-308
- [SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-84296.md)
  `CVE-2026-84296` · CVE record: Progress Software WS_FTP Server · CVSS 6.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Improper Authentication in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-84295.md)
  `CVE-2026-84295` · CVE record: Progress Software WS_FTP Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93680.md)
  `CVE-2026-93680` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-110245.md)
  `CVE-2026-110245` · CVE record: IBM Langflow OSS · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-115962.md)
  `CVE-2026-115962` · CVE record: myCred myCred · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-115967.md)
  `CVE-2026-115967` · CVE record: Hamid Alinia Login with phone number · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Kaspersky Network Agent and others](https://agentprime.io/advisories/CVE-2026-88941.md)
  `CVE-2026-88941` · CVE record: Kaspersky Network Agent and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter](https://agentprime.io/advisories/CVE-2026-111739.md)
  `CVE-2026-111739` · CVE record: Unknown Two Factor Authentication and 1 more · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass](https://agentprime.io/advisories/CVE-2026-88928.md)
  `CVE-2026-88928` · CVE record: Unknown PAYCOMET for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite](https://agentprime.io/advisories/CVE-2026-93757.md)
  `CVE-2026-93757` · CVE record: wild-apricot Wild Apricot Login · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover](https://agentprime.io/advisories/CVE-2026-96228.md)
  `CVE-2026-96228` · CVE record: sslplugins SSL Wireless SMS Notification · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token](https://agentprime.io/advisories/CVE-2026-109516.md)
  `CVE-2026-109516` · CVE record: guruteam Bot for Telegram on WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in canva ortto](https://agentprime.io/advisories/CVE-2026-113387.md)
  `CVE-2026-113387` · CVE record: canva ortto · CVSS 8.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell.](https://agentprime.io/advisories/CVE-2026-79589.md)
  `CVE-2026-79589` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.](https://agentprime.io/advisories/CVE-2026-107058.md)
  `CVE-2026-107058` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [AVideo-Encoder: missing authentication on control and status endpoints](https://agentprime.io/advisories/CVE-2026-61571.md)
  `CVE-2026-61571` · CVE record: WWBN AVideo-Encoder · CVSS 7.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Waline login accepts a non-string email as a match-all MongoDB query](https://agentprime.io/advisories/GHSA-jf75-q64q-g65r.md)
  `GHSA-jf75-q64q-g65r`, `CVE-2026-55369` · npm `@waline/vercel`: affected `<1.41.0`, fixed in `1.41.0` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass, Other injection
- [Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim](https://agentprime.io/advisories/GHSA-h2r5-x5m7-3935.md)
  `GHSA-h2r5-x5m7-3935`, `CVE-2026-115910` · PyPI `social-auth-core`: affected `<6.2.0`, fixed in `6.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass, CWE-345
- [Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs](https://agentprime.io/advisories/CVE-2026-118690.md)
  `CVE-2026-118690` · CVE record: SignalK signalk-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications](https://agentprime.io/advisories/GHSA-434m-5hcj-pxf3.md)
  `GHSA-434m-5hcj-pxf3`, `CVE-2026-118665` · npm `@graphql-tools/executor-legacy-ws`: affected `<1.1.36`, fixed in `1.1.36` · CVSS 8.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration](https://agentprime.io/advisories/GHSA-246p-cpwv-v3jq.md)
  `GHSA-246p-cpwv-v3jq`, `CVE-2026-118653`, `GO-2026-6872` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.0.0, <=4.16.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools](https://agentprime.io/advisories/CVE-2026-61542.md)
  `CVE-2026-61542` · CVE record: drhelius Gearboy · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS](https://agentprime.io/advisories/CVE-2026-63190.md)
  `CVE-2026-63190` · CVE record: fearlessgeekmedia FearlessCMS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Cross-site scripting (XSS), Information disclosure, Authentication bypass
- [Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events](https://agentprime.io/advisories/CVE-2026-6647.md)
  `CVE-2026-6647` · CVE record: WSO2 WSO2 Identity Server and 1 more · CVSS 7.4 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products \[Disrupted Authentication Flows\]](https://agentprime.io/advisories/CVE-2026-3583.md)
  `CVE-2026-3583` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 3.1 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware](https://agentprime.io/advisories/CVE-2026-118681.md)
  `CVE-2026-118681` · CVE record: go-chi chi · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Session fixation in Jenkins](https://agentprime.io/advisories/CVE-2026-117619.md)
  `CVE-2026-117619` · CVE record: Jenkins Project Jenkins · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions](https://agentprime.io/advisories/CVE-2026-115644.md)
  `CVE-2026-115644` · CVE record: Apache Software Foundation Apache Kafka · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed](https://agentprime.io/advisories/CVE-2026-103409.md)
  `CVE-2026-103409` · CVE record: Juniper Networks Session Smart Router · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in pretix](https://agentprime.io/advisories/CVE-2026-101274.md)
  `CVE-2026-101274` · CVE record: pretix · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-103779.md)
  `CVE-2026-103779` · CVE record: Dell PowerProtect Data Domain · CVSS 8.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Missing Authentication for Critical Function in Tactis' NoviGest Desktop App](https://agentprime.io/advisories/CVE-2026-112197.md)
  `CVE-2026-112197` · CVE record: Tactis NoviGest Desktop App · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Weak authentication in Acronis Cyber Protect Cloud Agent and others](https://agentprime.io/advisories/CVE-2025-30414.md)
  `CVE-2025-30414` · CVE record: Acronis Acronis Cyber Protect Cloud Agent and 1 more · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-86391.md)
  `CVE-2026-86391` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 6.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Improper authentication in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-86400.md)
  `CVE-2026-86400` · CVE record: Dell PowerProtect Data Domain · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-90717.md)
  `CVE-2026-90717` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN Secret](https://agentprime.io/advisories/CVE-2026-103331.md)
  `CVE-2026-103331` · CVE record: Unknown UniPAY Payment Gateway For WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter](https://agentprime.io/advisories/CVE-2026-109236.md)
  `CVE-2026-109236` · CVE record: zorem Customer Email Verification for WooCommerce · CVSS 4.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter](https://agentprime.io/advisories/CVE-2026-106013.md)
  `CVE-2026-106013` · CVE record: artbees Jupiter X Core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication](https://agentprime.io/advisories/CVE-2026-118129.md)
  `CVE-2026-118129` · CVE record: jeremyckahn Chitchatter · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305](https://agentprime.io/advisories/CVE-2026-102816.md)
  `CVE-2026-102816` · CVE record: TP-Link Systems Inc. RE305 v3 · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTI3VDE3OjQxOjIxLjYzNjAwMFoiLCJDVkUtMjAyNi0xMDI4MTYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTEwLTMwVDEwOjM0OjI0LjE1MTAwMFoiLCJDVkUtMjAyNi0yMjExMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTEwLTMwVDEwOjM0OjI0LjE1MTAwMFoiLCJDVkUtMjAyNi0yMjExMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.