Authentication bypass.

GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication

• Gibbon
• Authentication bypass

Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

• Apache Software Foundation Apache Qpid Broker-J
• Authentication bypass

Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7
• Authentication bypass

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verif…

• Authentication bypass

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not v…

• Authentication bypass

Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

• Gerrit
• Authentication bypass
• Broken access control

Botslab G980H Dashcams Missing Authentication for Critical Function

• Botslab G980H
• Authentication bypass

Botslab G980H Dashcams Missing Authentication for Critical Function

• Botslab G980H
• Authentication bypass

social-auth-core has a Session Fixation issue

• Authentication bypass

<5.0.0 · fixed in 5.0.0

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

• Authentication bypass
• Weak cryptography or TLS

<5.0.0 · fixed in 5.0.0

social-auth-core has an Improper Authentication issue

• Authentication bypass

<5.0.0 · fixed in 5.0.0

Botslab G980H Dashcams Authentication Bypass by Capture-replay

• Botslab G980H
• Authentication bypass

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

• Authentication bypass
• CWE-346

<0.22.5 · fixed in 0.22.5

Botslab G980H Dashcams Insufficient session expiration

• Botslab G980H
• Authentication bypass

phpMyFAQ's two-factor authentication login bypasses the password factor

• Authentication bypass

>=3.2.0, <4.1.6 · fixed in 4.1.6

Improper authentication in Dell Rugged Control Center (RCC)

• Dell Rugged Control Center (RCC)
• Authentication bypass

Improper authentication in Dell Rugged Control Center (RCC)

• Dell Rugged Control Center (RCC)
• Authentication bypass

Missing authentication in Dell ThinOS 10

• Dell ThinOS 10
• Authentication bypass

Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

• Honeywell PD45 Industrial Printer
• Command injection
• Authentication bypass

ZITADEL: MFA bypass via session reuse in Login V2

• Authentication bypass

<1.80.0-v2.20.0.20260717062356-56f4798ed31f · fixed in 1.80.0-v2.20.0.20260717062356-56f4798ed31f

volotat Anagnorisis Socket.IO Connect app.py missing authentication

• volotat Anagnorisis
• Authentication bypass

Snipe-IT: 2FA bypass via the API token flow

• Authentication bypass

<8.7.0 · fixed in 8.7.0

authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

• authentik
• Authentication bypass
• CWE-807

authentik: Authentication bypass via assertion confusion in SAML sources

• authentik
• Authentication bypass
• CWE-345

CVE-2026-75907

• Norwegian Cruise Line door access control
• Authentication bypass

Authentication bypass in PortSwigger Burp Suite DAST

• PortSwigger Burp Suite DAST
• Authentication bypass

Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Ansible Automation Platform 2.7
• Authentication bypass

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module

• qt
• Authentication bypass

Authentication Bypass in DIAEnergie

• Deltaww DIAEnergie
• Authentication bypass

SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

• signoz
• Authentication bypass

EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

• lynn999 EthPress – Web3 Login
• Authentication bypass

Klever-Go: /log controls global node logging

• Information disclosure
• Authentication bypass

<1.7.20 · fixed in 1.7.20

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

• weDevs WP User Frontend
• Authentication bypass

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

• weDevs WP User Frontend
• Authentication bypass

WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability

• WebFactory Captcha Code
• Authentication bypass

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

• Authentication bypass
• CWE-441

<0.5.2 · fixed in 0.5.2

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Authentication bypass

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Authentication bypass

Missing authentication in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Authentication bypass

Insufficient session expiration in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Authentication bypass

Broken Access Control vulnerability

• Zohocorp ManageEngine Applications Manager
• Authentication bypass

AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

• WatchGuard AuthPoint Authentication Gateway
• Authentication bypass
• CWE-636

Authentication Bypass vulnerability

• Zohocorp ManageEngine OpManager
• Authentication bypass

SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN

• SUMIT Payment Gateway for WooCommerce
• Authentication bypass

Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

• Apache Software Foundation Apache Tomcat
• Authentication bypass

Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

• Apache Software Foundation Apache Tomcat
• Authentication bypass

Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers

• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7
• Authentication bypass

Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

• Pollen Robotics Reachy Mini
• Authentication bypass
• Race condition

Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint

• Pollen Robotics Reachy Mini
• Authentication bypass
• CWE-494

Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

• Apache Software Foundation Apache Doris
• Authentication bypass

uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login

• NT-ware uniFLOW Online
• Authentication bypass

MQTT WebSocket Command Execution Vulnerability in NitroSense

• Acer NitroSense V5
• Command injection
• Authentication bypass

Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass

• Premium Packages
• Authentication bypass

WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution

• WP OAuth Server ( Login with WordPress )
• Authentication bypass

Authentication bypass by spoofing in OpenEye Apex Network Video Recorder (NVR)

• OpenEye Apex Network Video Recorder (NVR)
• Authentication bypass

Mstfakts College-Management-System Authentication server.php session_start session fixiation

• Mstfakts College-Management-System
• Authentication bypass

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Authentication bypass

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Authentication bypass

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

• Authentication bypass

<1.5.5 · fixed in 1.5.5

Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

• Authentication bypass

<1.0.1-0.20260715123057-dade1e2c8f27 · fixed in 1.0.1-0.20260715123057-dade1e2c8f27