Authentication bypass.

Tenda AC1206 Web UI telnet TendaTelnet missing authentication

• Tenda AC1206
• Authentication bypass

Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product

• ZTE ZXDU68 S202 V5.0
• Authentication bypass

Missing authentication in Dell PowerStore 500T and others

• Dell PowerStore 500T
• Dell PowerStore 1000T
• Authentication bypass

Linux Foundation Magma Registration Complete Message amf_fsm.cpp improper authentication

• Linux Foundation Magma
• Authentication bypass

WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

• WWBN AVideo
• Authentication bypass

WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

• WWBN AVideo
• Authentication bypass

Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure

• Keploy
• Authentication bypass

SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning

• cyberlord92 SAML Single Sign On – SSO Login
• Authentication bypass

KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

• kubeedge
• Authentication bypass

Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

• documenso
• Authentication bypass

Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

• jeremyevans rodauth
• Authentication bypass

Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

• jeremyevans rodauth
• Authentication bypass

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

• jeremyevans rodauth
• Authentication bypass

rust-iot-platform Authentication Bypass via Missing Request Guards

• iot-ecology rust-iot-platform
• Authentication bypass

Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

• User Profile Builder
• Authentication bypass

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

• IBM Langflow OSS
• Authentication bypass

IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].

• IBM Administration Runtime Expert for i
• Authentication bypass

IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].

• IBM Administration Runtime Expert for i
• Authentication bypass

WireGuard keepalive transport-data messages accepted without Poly1305 authentication

• zephyr
• Authentication bypass

Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack

• zephyr
• Authentication bypass

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

• Broken access control
• Authentication bypass

<0.0.0-20260615160325-38402ad2ebdd · fixed in 0.0.0-20260615160325-38402ad2ebdd

Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances

• Authentication bypass

>=2.39.0, <2.39.4 || >=2.40.0, <2.43.0 · fixed in 2.39.4, 2.43.0

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

• Authentication bypass
• Server-side request forgery (SSRF)

<0.5.2 · fixed in 0.5.2

phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

• Authentication bypass

<3.4.6 · fixed in 3.4.6

Potential authentication bypass leading to administrative access in Artifactory

• jfrog artifactory
• Authentication bypass

Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

• atlantis
• Authentication bypass

Argo Rollouts Dashboard Unauthenticated Mutating Operations

• argoproj argo-rollouts
• Authentication bypass

StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

• starrocks
• Authentication bypass

Gophish Account Lockout and Forced Password Change Bypassable via API Key

• gophish
• Authentication bypass

Redpanda Admin API Unauthenticated Superuser Access via Default Configuration

• redpanda
• Authentication bypass

Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure

• zipkin
• Authentication bypass

WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

• WPMU DEV Forminator
• Authentication bypass

Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others

• Open-Xchange GmbH OX Dovecot Pro
• Open-Xchange GmbH OX Dovecot CE
• Authentication bypass

Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others

• Open-Xchange GmbH OX Dovecot Pro
• Open-Xchange GmbH OX Dovecot CE
• Authentication bypass

Improper authentication in Open-Xchange GmbH OX Dovecot Pro and others

• Open-Xchange GmbH OX Dovecot Pro
• Open-Xchange GmbH OX Dovecot CE
• Authentication bypass

WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

• WPDeveloper Essential Addons for Elementor
• Authentication bypass

WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting

• WatchGuard Dimension
• Information disclosure
• Authentication bypass

Ebyte NA111-M Missing Authentication for Critical Function

• Ebyte NA111-M Firmware
• Authentication bypass

Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel

• Xiiaozet LK100W
• Authentication bypass

Xiiaozet LK100W Missing Authentication for Critical Function

• Xiiaozet LK100W
• Authentication bypass

Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

• Ebyte NA111-M Firmware
• Authentication bypass

Ebyte NA111-M Missing Authentication for Critical Function

• Ebyte NA111-M Firmware
• Authentication bypass

FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

• labring FastGPT
• Authentication bypass
• Broken access control

Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

• Unitree Robotics G1 EDU
• Authentication bypass
• Memory corruption

Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal

• Unitree Robotics G1 EDU
• Path traversal
• Authentication bypass

openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that de...

• Authentication bypass

<1.4.9 · fixed in 1.4.9

UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

• bytedance UI-TARS-desktop
• Authentication bypass

OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route

• faas
• Authentication bypass

Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

• team-telnyx telnyx-mcp
• Authentication bypass

mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication

• mcp-router
• Authentication bypass

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints

• apitable
• Authentication bypass

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint

• apitable
• Authentication bypass

Flowintel Fails to Invalidate Active Sessions After Password Change

• flowintel
• Authentication bypass

HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

• HCL Software IEM
• Authentication bypass

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.

• Authentication bypass

Reactor Netty HTTP Server may incorrectly evaluate proxy addresses

• Spring Reactor Netty
• Authentication bypass

KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

• 1Panel-dev KubePi
• Authentication bypass

itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication

• itsourcecode Payroll System
• Authentication bypass

Authentication bypass in Veeam One

• Veeam One
• Authentication bypass

Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled

• static-web-server
• Authentication bypass