Authentication bypass.

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover

• teddy-bear-customize-addon
• Authentication bypass

Authentication bypass in Brainzcompany Zenius EMS 8.0

• Brainzcompany Zenius EMS 8.0
• Authentication bypass
• CWE-1286

An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earl…

• Authentication bypass

[UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks

• Concrete CMS
• Authentication bypass

Traefik HTTP/3 Backend NTLM Connection Reuse

• Authentication bypass
• Broken access control

>=2.11.0, <2.11.57 · fixed in 2.11.57

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

• Authentication bypass

<1.75.1 · fixed in 1.75.1

Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

• Authentication bypass
• Broken access control

>=0.9.0, <0.11.1 · fixed in 0.11.1

Langflow is vulnerable to authentication bypass and insufficient session expiration

• IBM Langflow OSS
• Authentication bypass

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

• IBM DataStage on Cloud Pak for Data
• Authentication bypass

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

• Authentication bypass
• CWE-155

>=0.6.41, <0.11.1 · fixed in 0.11.1

OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

• Code injection
• Authentication bypass

<=3.8.50 · no fixed version yet

n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

• Authentication bypass

<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2 · fixed in 1.123.76, 2.37.7, 2.38.2

Authentication bypass by spoofing in Lenovo Software Fix

• Lenovo Software Fix
• Authentication bypass

Traefik: ForwardAuth identity spoofing via dot-form header alias

• Authentication bypass

<2.11.56 · fixed in 2.11.56

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

• IBM WebSphere Application Server
• Authentication bypass

WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability

• WEN Solutions WP Travel
• Authentication bypass

WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability

• IMPress for IDX Broker
• Authentication bypass

WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability

• MailMunch – Grow your Email List
• Authentication bypass

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability

• Elliot Sowers/ RelyWP Simple Cloudflare Turnstile
• Authentication bypass

CyberPanel before 3.0.5 Authentication Bypass via API

• usmannasir cyberpanel
• Authentication bypass

Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization

• Cap-go capgo.app
• Authentication bypass

GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service

• GeoVision Inc. GV-LPC2011/LPC2211
• Authentication bypass

GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay

• GeoVision Inc. GV-LPCLPC2011/2211
• Authentication bypass

Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7
• Authentication bypass

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

• miniOrange 2FA
• Authentication bypass

Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

• Apache Software Foundation Apache Artemis
• Apache Software Foundation Apache ActiveMQ Artemis
• Authentication bypass

Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

• Apache Software Foundation Apache Artemis
• Apache Software Foundation Apache ActiveMQ Artemis
• Authentication bypass

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

• Apache Software Foundation Apache Artemis
• Apache Software Foundation Apache ActiveMQ Artemis
• Authentication bypass

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

• Apache Software Foundation Apache Artemis
• Apache Software Foundation Apache ActiveMQ Artemis
• Authentication bypass

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

• Apache Software Foundation Apache Artemis
• Apache Software Foundation Apache ActiveMQ Artemis
• Authentication bypass

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

• Authentication bypass

<2.8.12 · fixed in 2.8.12

webhookd: Unrestricted HTTP Header to Shell Variable Injection

• Authentication bypass
• CWE-807

<1.22.0 · fixed in 1.22.0

Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication

• Rizwan17 inventory-management-system
• Authentication bypass

Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication

• Rizwan17 inventory-management-system
• Authentication bypass

Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function

• Softish EarVision Android application
• Softish C6 Ear Camera
• Authentication bypass

Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing

• Softish EarVision Android application
• Softish C6 Ear Camera
• Authentication bypass

IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header

• IP2Location Country Blocker
• Authentication bypass

tirreno has Session Fixation in Login Authentication

• tirreno
• Authentication bypass

Missing authentication in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Authentication bypass

Unlimited authentication attempts in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Authentication bypass

Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

• parse-community parse-server
• Authentication bypass

Insufficient session expiration in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Authentication bypass

Improper Authorization in Yordam Informatics' Library Reservation System

• Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System
• Authentication bypass

Improper authentication in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Authentication bypass

Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

• Newfold WP Plugin Web
• Newfold WP Plugin Crazy Domains
• Authentication bypass

Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

• martinnguyen1990 Next-Cart Store to WooCommerce Migration
• Authentication bypass

Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches

• macropay-solutions maravel-framework
• Authentication bypass
• CWE-672

Windows ML CLI: CORS misconfig enables localhost RCE

• Authentication bypass
• CWE-942

<0.4.0 · fixed in 0.4.0

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

• Auth0 AD/LDAP Connector
• Authentication bypass

Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

• Okta Hyperdrive Agent
• Authentication bypass

Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

• Okta Access Gateway
• Authentication bypass

Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

• Open-Web-Analytics
• Authentication bypass

Information disclosure in Eclipse Foundation Eclipse aeriOS

• Eclipse Foundation Eclipse aeriOS
• Information disclosure
• Authentication bypass

moltis-org moltis vault.rs vault_recovery_handler missing authentication

• moltis
• Authentication bypass

ningzichun Student Management System login.php session_start session fixiation

• ningzichun Student Management System
• Authentication bypass

Authentication bypass in Google Android

• Google Android
• Authentication bypass

Improper authentication in Google Android

• Google Android
• Authentication bypass

Photoshop Mobile | Session Fixation (CWE-384)

• Adobe Photoshop Android
• Authentication bypass

Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability

• Microsoft Authentication Library
• Authentication bypass

Spring Cloud Azure Elevation of Privilege Vulnerability

• Microsoft Spring Cloud Azure
• Authentication bypass