Authentication bypass.

tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication

• tsi-coop tsi-dpdp-cms
• Authentication bypass

tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication

• tsi-coop tsi-dpdp-cms
• Authentication bypass

Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability

• Delinea Secret Server (On-Prem)
• Authentication bypass

Open edX LTI OAuth Replay Attack

• openedx-platform
• Authentication bypass

Session takeover via Auth Proxy cache key collision

• Grafana Enterprise
• Grafana OSS
• Authentication bypass
• Broken access control

SAML assertion replay via skipped InResponseTo validation

• Grafana Enterprise
• Authentication bypass

Session fixation in Jenkins

• Jenkins
• Authentication bypass

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

• Authentication bypass

<0.0.0-20260512171108-5e8f99f40a8a · fixed in 0.0.0-20260512171108-5e8f99f40a8a

Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud

• Rockwell Automation DataMosaix™ Private Cloud
• Authentication bypass

Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

• Notification Bar for WordPress
• Authentication bypass

CVE-2026-100871: JWT audience confusion allows shop customer to authenticate as administrator

• Authentication bypass

>=1.11.0, <1.12.0 || >=1.12.0, <1.12.25 || >=1.13.0, <1.13.17 || >=1.14.0, <1.14.20 || >=2.0.0, <2.1.0 || >=2.1.0, <2.1.16 || >=2.2.0, <2.2.9 · fixed in 1.12.0, 1.12.25, 1.13.17, 1.14.20, 2.1.0, 2.1.16, 2.2.9

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

• Drupal Disable Login Page
• Authentication bypass

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

• Drupal CAPTCHA Protected Page
• Authentication bypass

OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

• OAuth Single Sign On
• Authentication bypass

Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

• Advanced Custom Fields: Extended
• Authentication bypass

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint

• apitable
• Authentication bypass

Pika Unauthenticated Replication Access via Internal Protobuf Port

• OpenAtomFoundation pikiwidb
• Authentication bypass

Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands

• Phison Electronics Corporation PS3111-S11 Controller Firmware
• Authentication bypass

Missing authentication in Oxford Nanopore MinKNOW

• Oxford Nanopore MinKNOW
• Authentication bypass

Casdoor upload-resource API resource.go missing authentication

• Casdoor
• Authentication bypass

WWBN AVideo Password Recovery Token Expiration Bypass

• WWBN AVideo
• Authentication bypass

WWBN AVideo Authentication Bypass via User-Agent Header

• WWBN AVideo
• Authentication bypass

WWBN AVideo Authentication Bypass via X-Real-IP Header

• WWBN AVideo
• Authentication bypass

Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

• Proxmox Server Solutions GmbH Proxmox Virtual Environment (VE)
• Authentication bypass

Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

• Authentication bypass

>=4.0.0, <4.12.6 || >=5.0.0, <5.7.6 · fixed in 4.12.6, 5.7.6

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

• Authentication bypass

>=4.0.0, <4.12.0 || >=5.0.0, <5.7.0 · fixed in 4.12.0, 5.7.0

Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint

• Hewlett Packard Enterprise (HPE) AOS-CX
• Authentication bypass

Improper Authentication Handling in AOS-CX Management Interface and API

• Hewlett Packard Enterprise (HPE) AOS-CX
• Authentication bypass

Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Authentication bypass

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Authentication Bypasses in API allow Continued Authenticated Access in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Authentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Unauthenticated Denial of Service Vulnerabilities in API Endpoint of HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Authentication bypass

Missing authentication in Dell PowerStore 500T and others

• Dell PowerStore 500T
• Dell PowerStore 1000T
• Authentication bypass

Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change

• memos
• Authentication bypass

Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software

• TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software
• Authentication bypass

Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication

• Cleo Harmony
• Authentication bypass

Unlimited authentication attempts in Schneider Electric PowerChute™ Serial Shutdown

• Schneider Electric PowerChute™ Serial Shutdown
• Authentication bypass

ControlFLASH ® – Improper Access Control

• Rockwell Automation ControlFLASH ®
• Authentication bypass

Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalation

• Rockwell Automation FactoryTalk® Activation Manager
• Authentication bypass

Authentication bypass by spoofing in Dell PowerStore 500T and others

• Dell PowerStore 500T
• Dell PowerStore 1000T
• Authentication bypass

Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding

• wpinsider-1 Simple Membership
• Authentication bypass

Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token

• devitemsllc Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
• Authentication bypass

cu silicon edit Endpoint views.py create_app missing authentication

• cu silicon
• Authentication bypass

Wallos: OIDC account takeover via email-based account linking without `email_verified` check

• ellite Wallos
• Authentication bypass

Wallos: Unauthenticated database replacement via import endpoint on fresh install

• ellite Wallos
• Authentication bypass

WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

• SiteGround Security
• Authentication bypass

WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

• Metagauss RegistrationMagic
• Authentication bypass

QuantumNous new-api Revoked API Token token session expiration

• QuantumNous new-api
• Authentication bypass

Missing Authentication for Critical Function in wallos

• ellite Wallos
• Authentication bypass

sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication

• sdcb chats
• Authentication bypass

Ebyte NA111-M Weak Authentication

• Ebyte NA111-M Firmware
• Authentication bypass

Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

• Fahad Mahmood Keep Backup Daily
• Authentication bypass

ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

• Proper Fraction ProfilePress
• Authentication bypass
• Weak cryptography or TLS

Tenda AC18 Telnet telnet missing authentication

• Tenda AC18
• Authentication bypass

Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication

• Tenda AC1206
• Authentication bypass