Authentication bypass.

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

• Authentication bypass
• Broken access control

<0.22.0 · fixed in 0.22.0

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

• Path traversal
• Authentication bypass

<0.22.0 · fixed in 0.22.0

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

• Authentication bypass
• CWE-348

>=1.6.6, <1.7.2 · fixed in 1.7.2

MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

• sooperset mcp-atlassian
• Authentication bypass

9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

• Authentication bypass
• CWE-807

<0.5.8 · fixed in 0.5.8

Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

• GitroomHQ postiz-app
• Authentication bypass
• Denial of service

Refresh tokens accepted as private repository credentials at the CDN

• hexpm
• Authentication bypass

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

• Authentication bypass

<2.4.0 · fixed in 2.4.0

@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

• Authentication bypass

<2.4.0 · fixed in 2.4.0

Missing authentication in NVIDIA Infrastructure Controller

• NVIDIA Infrastructure Controller
• Authentication bypass

Improper authentication in NVIDIA Infrastructure Controller

• NVIDIA Infrastructure Controller
• Authentication bypass

Authentication bypass vulnerability

• Zohocorp ManageEngine ADSelfService Plus
• Authentication bypass

dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication

• dgtlmoon changedetection.io
• Authentication bypass

mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

• Authentication bypass

>=0.14.0, <0.16.2 · fixed in 0.16.2

WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability

• Magepeople inc. Taxi Booking Manager for WooCommerce
• Authentication bypass

Gigatech PDV5701 WebSocket Service index.html missing authentication

• Gigatech PDV5701
• Authentication bypass

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration.

• Authentication bypass

webpy web.py 0.76 is vulnerable to Session Fixation.

• Authentication bypass

pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from the HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without v…

• Authentication bypass

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0.

• Authentication bypass

nginx ignition has TOTP Reuse During Validity Window

• Authentication bypass

>=0.0.0-20260217145239-1cbfae0296f1, <0.0.0-20260328015550-8d35e1eb5dd6 · fixed in 0.0.0-20260328015550-8d35e1eb5dd6

DesktopSMS 1.11.0 Unauthorized Access via Local Service

• MrPear DesktopSMS
• Authentication bypass

Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)

• laurent22 joplin
• Authentication bypass

Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

• laurent22 joplin
• Authentication bypass

MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

• 1Panel-dev MaxKB
• Authentication bypass

Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

• warp-tech warpgate
• Authentication bypass
• CWE-116

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

• Authentication bypass
• Cross-site request forgery (CSRF)

<0.91.1 · fixed in 0.91.1

Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

• Mailu
• Mailu helm-charts
• Authentication bypass
• CWE-807

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead,...

• Authentication bypass

>=3.0.0, <3.3.2 · fixed in 3.3.2

When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverti...

• Authentication bypass

<=3.3.0 · no fixed version yet

Omega Solution HRM OS Role Permission API permission missing authentication

• Omega Solution HRM OS
• Authentication bypass

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.

• Authentication bypass

A session invalidation flaw exists in x-ui 0.3.2.

• Authentication bypass

WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL

• Watchdog Anti-Virus
• Authentication bypass
• CWE-20

mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

• mayswind ezBookkeeping
• Authentication bypass

NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication

• NginxProxyManager nginx-proxy-manager
• Authentication bypass

Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

• Pixelfed
• Authentication bypass

OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

• openpanel
• Authentication bypass

Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register

• wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
• Authentication bypass

CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

• 1Panel-dev CordysCRM
• Authentication bypass
• Broken access control

CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

• 1Panel-dev CordysCRM
• Authentication bypass
• Broken access control

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Authentication bypass

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Authentication bypass

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Authentication bypass

IBM Sterling File Gateway is Vulnerable to Authentication Bypass

• IBM Sterling File Gateway
• Authentication bypass

LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

• ModelTC LightLLM
• Authentication bypass

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

• IBM WebSphere Application Server
• Authentication bypass

Saleor throttling.py get_client_ip excessive authentication

• Saleor
• Authentication bypass
• CWE-799

SysReptor: Session Fixation in Password-Protected Shared Notes

• Syslifters sysreptor
• Authentication bypass

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

• Authentication bypass
• CWE-346

<1.120.0 · fixed in 1.120.0

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

• Broken access control
• Authentication bypass

<0.30.1 · fixed in 0.30.1

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

• Authentication bypass
• CWE-302

<0.31.4 || >=0.32.0, <0.32.2 · fixed in 0.31.4, 0.32.2

Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication

• Forget-C Jellyfish AI Short Drama Studio
• Authentication bypass

CareCam CM2507 Missing Authentication for Critical Function

• CareCam HMT.CM2507 Firmware
• Authentication bypass

CareCam CM2507 Missing Authentication for Critical Function

• CareCam HMT.CM2507 Firmware
• Authentication bypass

CareCam CM2507 Missing Authentication for Critical Function

• CareCam HMT.CM2507 Firmware
• Authentication bypass

gedelumbung HospitalManagement Password Change password.php simpan improper authentication

• gedelumbung HospitalManagement
• Authentication bypass

Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• Authentication bypass

Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0

• T-Systems TAO
• Authentication bypass

Unlimited authentication attempts in Synology DiskStation Manager (DSM)

• Synology DiskStation Manager (DSM)
• Authentication bypass