# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource](https://agentprime.io/advisories/GHSA-55gf-3263-4r39.md)
  `GHSA-55gf-3263-4r39`, `CVE-2026-118505`, `EEF-CVE-2026-118505` · Hex `ash_authentication`: affected `>=5.0.0-rc.4, <5.0.0-rc.16`, fixed in `5.0.0-rc.16` · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot](https://agentprime.io/advisories/CVE-2026-121557.md)
  `CVE-2026-121557` · CVE record: wppconnect wppconnect-server · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb](https://agentprime.io/advisories/CVE-2026-121555.md)
  `CVE-2026-121555` · CVE record: DrizzleTime Foxel · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests](https://agentprime.io/advisories/CVE-2026-121454.md)
  `CVE-2026-121454` · CVE record: padloc padloc · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Authentication bypass vulnerability](https://agentprime.io/advisories/CVE-2026-77800.md)
  `CVE-2026-77800` · CVE record: Zohocorp ManageEngine Key Manager Plus · CVSS 7.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Two-factor authentication bypass](https://agentprime.io/advisories/CVE-2026-77799.md)
  `CVE-2026-77799` · CVE record: Zohocorp ManageEngine Key Manager Plus · CVSS 7.4 High · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture](https://agentprime.io/advisories/CVE-2026-120538.md)
  `CVE-2026-120538` · CVE record: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy · CVSS 8.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover](https://agentprime.io/advisories/CVE-2026-120574.md)
  `CVE-2026-120574` · CVE record: surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments · CVSS 8.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass
- [Authentication bypass in Johnson Controls EasyIO Neo EC and CW Edge Controller](https://agentprime.io/advisories/CVE-2026-71450.md)
  `CVE-2026-71450` · CVE record: Johnson Controls EasyIO Neo EC and CW Edge Controller · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Improper authentication in Google Android](https://agentprime.io/advisories/CVE-2026-58915.md)
  `CVE-2026-58915` · CVE record: Google Android · CVSS 6.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Dell Alienware Command Center (AWCC)](https://agentprime.io/advisories/CVE-2026-91896.md)
  `CVE-2026-91896` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 3.9 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Nexbox A95X Amlogic S905X UART Unauthenticated Console Access](https://agentprime.io/advisories/CVE-2026-119740.md)
  `CVE-2026-119740` · CVE record: Nexbox A95X · CVSS 7.0 High · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Munshi Payment Bypass via Unauthenticated Webhook Endpoint](https://agentprime.io/advisories/CVE-2026-119731.md)
  `CVE-2026-119731` · CVE record: Petpooja Munshi · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass, CWE-345
- [Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules](https://agentprime.io/advisories/CVE-2026-88810.md)
  `CVE-2026-88810` · CVE record: SUSE Rancher · CVSS 7.2 High · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access](https://agentprime.io/advisories/CVE-2026-77877.md)
  `CVE-2026-77877` · CVE record: Control Web Panel Control Web Panel · CVSS 8.5 High · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code](https://agentprime.io/advisories/CVE-2026-120447.md)
  `CVE-2026-120447` · CVE record: bufanyun HotGo · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API](https://agentprime.io/advisories/CVE-2026-120446.md)
  `CVE-2026-120446` · CVE record: madong-code madong-admin-saas · CVSS 8.8 High · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway](https://agentprime.io/advisories/CVE-2026-116606.md)
  `CVE-2026-116606` · CVE record: Barracuda Networks Barracuda Email Security Gateway (ESG) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts](https://agentprime.io/advisories/CVE-2024-9517.md)
  `CVE-2024-9517` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [mathurvishal CloudClassroom-PHP-Project Global Session session expiration](https://agentprime.io/advisories/CVE-2026-120340.md)
  `CVE-2026-120340` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 6.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations](https://agentprime.io/advisories/CVE-2026-120314.md)
  `CVE-2026-120314` · CVE record: Jovancoding Network-AI · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication](https://agentprime.io/advisories/CVE-2026-120278.md)
  `CVE-2026-120278` · CVE record: WAVLINK WN536AX6-A · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass
- [Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication](https://agentprime.io/advisories/CVE-2026-82840.md)
  `CVE-2026-82840` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.2 High · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass
- [Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation](https://agentprime.io/advisories/CVE-2026-82559.md)
  `CVE-2026-82559` · CVE record: Apache Software Foundation Apache Wicket · CVSS 2.3 Low · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass
- [Gitea OAuth2 account auto-linking takeover through the sign-up form](https://agentprime.io/advisories/CVE-2026-120263.md)
  `CVE-2026-120263` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass, Broken access control
- [Presenton API missing authentication](https://agentprime.io/advisories/CVE-2026-120191.md)
  `CVE-2026-120191` · CVE record: Presenton · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass
- [Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback](https://agentprime.io/advisories/CVE-2026-103898.md)
  `CVE-2026-103898` · CVE record: roxnor Wp Social Login and Register Social Counter · CVSS 8.1 High · Not analysed yet · Published 31 Oct 2026 · Tags: Authentication bypass
- [Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter](https://agentprime.io/advisories/CVE-2026-119096.md)
  `CVE-2026-119096` · CVE record: uncannyowl Uncanny Toolkit for LearnDash · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Authentication bypass
- [Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member\[ID\]' Parameter](https://agentprime.io/advisories/CVE-2026-119166.md)
  `CVE-2026-119166` · CVE record: uscnanbu Welcart e-Commerce · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Authentication bypass
- [UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash](https://agentprime.io/advisories/CVE-2026-119980.md)
  `CVE-2026-119980` · CVE record: stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP · CVSS 6.5 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Authentication bypass
- [Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting](https://agentprime.io/advisories/CVE-2026-118185.md)
  `CVE-2026-118185` · CVE record: Unknown Security Optimizer · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2026 · Tags: Authentication bypass
- [Unverified Sign in with Apple callback parameter can override verified ID token claims](https://agentprime.io/advisories/GHSA-9fr5-g44g-9526.md)
  `GHSA-9fr5-g44g-9526`, `CVE-2026-117656`, `EEF-CVE-2026-117656` · Hex `assent`: affected `>=0.1.25, <0.3.2`, fixed in `0.3.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-349
- [Coop sessions are not invalidated on password reset](https://agentprime.io/advisories/CVE-2026-63400.md)
  `CVE-2026-63400` · CVE record: roostorg coop · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Coop has SAML cross-tenant authentication bypass](https://agentprime.io/advisories/CVE-2026-63398.md)
  `CVE-2026-63398` · CVE record: roostorg coop · CVSS 7.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Coop has a data leak via unauthenticated GraphQL Query.allOrgs](https://agentprime.io/advisories/CVE-2026-63396.md)
  `CVE-2026-63396` · CVE record: roostorg coop · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg](https://agentprime.io/advisories/CVE-2026-63399.md)
  `CVE-2026-63399` · CVE record: roostorg coop · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-799
- [TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover](https://agentprime.io/advisories/CVE-2026-63377.md)
  `CVE-2026-63377` · CVE record: fctr-id okta-ai-agent · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts](https://agentprime.io/advisories/CVE-2026-63115.md)
  `CVE-2026-63115` · CVE record: TryGhost ActivityPub · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [MoLing: unauthenticated SSE and wildcard CORS expose tool sessions](https://agentprime.io/advisories/CVE-2026-62863.md)
  `CVE-2026-62863` · CVE record: gojue moling · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-942
- [pgAdmin 4: A user's other sessions survive a change of their password](https://agentprime.io/advisories/CVE-2026-116251.md)
  `CVE-2026-116251` · CVE record: pgadmin.org pgAdmin 4 · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username](https://agentprime.io/advisories/CVE-2026-116239.md)
  `CVE-2026-116239` · CVE record: pgadmin.org pgAdmin 4 · CVSS 8.9 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control
- [pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks](https://agentprime.io/advisories/CVE-2026-116238.md)
  `CVE-2026-116238` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force](https://agentprime.io/advisories/CVE-2026-115829.md)
  `CVE-2026-115829` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [MyTube: Unauthenticated Media Access via Static Routes Bypassing Login](https://agentprime.io/advisories/CVE-2026-62302.md)
  `CVE-2026-62302` · CVE record: franklioxygen MyTube · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster](https://agentprime.io/advisories/CVE-2026-104623.md)
  `CVE-2026-104623` · CVE record: SUSE Rancher · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace](https://agentprime.io/advisories/CVE-2026-104615.md)
  `CVE-2026-104615` · CVE record: SUSE Rancher · CVSS 7.9 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [SerpBear before 3.1.1 Missing Authentication via POST /api/notify](https://agentprime.io/advisories/CVE-2026-119705.md)
  `CVE-2026-119705` · CVE record: towfiqi serpbear · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header](https://agentprime.io/advisories/CVE-2026-119703.md)
  `CVE-2026-119703` · CVE record: xinnan-tech xiaozhi-esp32-server · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)](https://agentprime.io/advisories/CVE-2026-61739.md)
  `CVE-2026-61739` · CVE record: socfortress CoPilot · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control
- [SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount](https://agentprime.io/advisories/CVE-2026-61730.md)
  `CVE-2026-61730` · CVE record: socfortress CoPilot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials
- [SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection](https://agentprime.io/advisories/CVE-2026-61729.md)
  `CVE-2026-61729` · CVE record: socfortress CoPilot · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover](https://agentprime.io/advisories/CVE-2026-110799.md)
  `CVE-2026-110799` · CVE record: givanz Vvveb · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91914.md)
  `CVE-2026-91914` · CVE record: Dell OpenManage Enterprise · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-111500.md)
  `CVE-2026-111500` · CVE record: Dell OpenManage Enterprise · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections](https://agentprime.io/advisories/CVE-2026-119577.md)
  `CVE-2026-119577` · CVE record: ArcadeData arcadedb · CVSS 7.6 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider](https://agentprime.io/advisories/CVE-2026-119572.md)
  `CVE-2026-119572` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Unlimited authentication attempts in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-111501.md)
  `CVE-2026-111501` · CVE record: Dell OpenManage Enterprise · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP](https://agentprime.io/advisories/CVE-2026-119425.md)
  `CVE-2026-119425` · CVE record: opnsense core · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation](https://agentprime.io/advisories/CVE-2026-119420.md)
  `CVE-2026-119420` · CVE record: getlago lago · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Missing authentication check on POST/PUT requests](https://agentprime.io/advisories/CVE-2026-22110.md)
  `CVE-2026-22110` · CVE record: Delta Electronics Delta UFC500 · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTEwLTMwVDEwOjM0OjI0LjE1MTAwMFoiLCJDVkUtMjAyNi0yMjExMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTExLTAzVDE2OjI5OjM4LjAwMDAwMFoiLCJHSFNBLW0zcXItZnZwNC03OHhqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTExLTAzVDE2OjI5OjM4LjAwMDAwMFoiLCJHSFNBLW0zcXItZnZwNC03OHhqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.