Authentication bypass.

lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint

• dromara lamp-cloud
• Authentication bypass

Session Fixation

• Secomea GateManager
• Authentication bypass

stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication

• stamparm maltrail
• Authentication bypass

Insufficient session expiration in bizwell xClick

• bizwell xClick
• Authentication bypass

PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication

• PHPGurukul Blood Donor Management System
• Authentication bypass

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segm…

• Arista Networks EOS
• Authentication bypass

goproxy through 15.3 Authentication Bypass via CONNECT

• snail007 goproxy
• Authentication bypass

The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control

• IBM Sterling B2B Integrator
• IBM Sterling File Gateway
• Authentication bypass

Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

• MarcosCamara01 Ecommerce Template
• Authentication bypass

Insufficiently random values in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Authentication bypass
• Weak cryptography or TLS

Authentication bypass by spoofing in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Authentication bypass

Improper authentication in Apple iOS and iPadOS

• Apple iOS and iPadOS
• Authentication bypass

Improper authentication in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Authentication bypass

Improper authentication in Apple iOS and iPadOS

• Apple iOS and iPadOS
• Authentication bypass

Improper authentication in Apple macOS

• Apple macOS
• Authentication bypass

Improper authentication in Apple iOS and iPadOS

• Apple iOS and iPadOS
• Authentication bypass

Langflow is vulnerable to authentication bypass and insufficient session expiration

• IBM Langflow OSS
• Authentication bypass

Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

• IBM Langflow OSS
• Authentication bypass

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

• i
• Authentication bypass

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

• Authentication bypass

<1.0.12 · fixed in 1.0.12

Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

• krayin laravel-crm
• Authentication bypass

Authentication bypass by spoofing in Eclipse Foundation Eclipse Data Plane Core

• Eclipse Foundation Eclipse Data Plane Core
• Authentication bypass
• CWE-345

MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials

• MISP
• Authentication bypass
• CWE-20

LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

• LangBot
• Authentication bypass

Improper Claim Validation in PingAM OIDC Provider

• Ping Identity PingAM
• Authentication bypass

Apache Syncope: JWT subject spoofing

• Apache Software Foundation Apache Syncope
• Authentication bypass

Bifrost unauthenticated remote code execution via MCP stdio client registration

• maximhq Bifrost
• Broken access control
• Authentication bypass

Missing authentication in Contec Co., Ltd. CPSL-08P1EN

• Contec Co., Ltd. CPSL-08P1EN
• Authentication bypass

Missing authentication in Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*

• Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
• Authentication bypass

andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation

• andreashappe cochise
• Authentication bypass
• Weak cryptography or TLS

0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication

• 0x4m4 HexStrike AI
• Authentication bypass

Authentication bypass by spoofing in N-able Mail Assure

• N-able Mail Assure
• Authentication bypass

getzep graphiti REST API main.py improper authentication

• getzep graphiti
• Authentication bypass

cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication

• cheshire-cat-ai Cheshire Cat AI
• Authentication bypass

jaychouchannel Tourism-Management-System Update Endpoint missing authentication

• jaychouchannel Tourism-Management-System
• Authentication bypass

simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication

• simalexan api-lambda-send-email-ses
• Authentication bypass

vvbbnn00 WARP-Clash-API authorized missing authentication

• vvbbnn00 WARP-Clash-API
• Authentication bypass

Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

• Really Simple Security
• Authentication bypass

WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

• WWBN AVideo
• Authentication bypass

MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

• samanhappy mcphub
• Authentication bypass

Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

• Frontegg SAML SSO
• Authentication bypass

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

• Authentication bypass

<4.15.3 · fixed in 4.15.3

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

• Authentication bypass
• Cross-site request forgery (CSRF)

<9.7.0 · fixed in 9.7.0

Missing Authentication for Critical Function in Malcolm

• CISA Malcolm
• Authentication bypass

Authentication Bypass by Spoofing in Malcolm

• CISA Malcolm
• Authentication bypass

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

• Authentication bypass

<5.30.3 · fixed in 5.30.3

ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider

• Authentication bypass

<3.4.12 || >=4.0.0-rc.1, <4.15.2 · fixed in 3.4.12, 4.15.2

Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

• t-mart mousehole
• Information disclosure
• Authentication bypass

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

• Authentication bypass
• CWE-346

<0.4.2 · fixed in 0.4.2

GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

• GetSimpleCMS-CE
• GetSimpleCMS
• Broken access control
• Authentication bypass

Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation

• LaciSynchroni server
• Authentication bypass
• CWE-349

MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

• moxi624 MoguBlog
• Authentication bypass

MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

• moxi624 MoguBlog
• Authentication bypass

CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project wit…

• Schneider Electric Modicon M580
• Schneider Electric Modicon M580 Safety
• Authentication bypass

Privilege Escalation in Progress Chef Automate

• Progress Software Chef Automate
• Authentication bypass

WWBN AVideo Unauthenticated File Read via getRecordedFile.php

• WWBN AVideo
• Authentication bypass

Howyar｜WeenyGenius - Missing Authentication

• Howyar WeenyGenius
• Authentication bypass

Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection

• Kingdom Communication Associated EH3040
• Kingdom Communication Associated EH4200
• Authentication bypass

SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

• SSL Zen — SSL Certificate Installer & HTTPS Redirects
• Authentication bypass

Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover

• advanced-customized-prompts
• Authentication bypass