Authentication bypass.

Improper authentication in Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7

• Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7
• Authentication bypass

Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

• Casdoor
• Authentication bypass

Ticket host-binding bypass via spoofed client IP in P4Search

• Perforce P4 (Helix Core)
• Authentication bypass

linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication

• linlinjava litemall
• Authentication bypass
• CWE-799

kishor-23 food-waste-management-system Login Flow login.php session fixiation

• kishor-23 food-waste-management-system
• Authentication bypass

kishor-23 food-waste-management-system Admin Signup signup.php missing authentication

• kishor-23 food-waste-management-system
• Authentication bypass

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

• zitadel
• Authentication bypass

ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

• zitadel
• Authentication bypass

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

• zitadel
• Authentication bypass

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

• zitadel
• Authentication bypass

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

• zitadel
• Authentication bypass

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

• AhsayCBS
• Authentication bypass

OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface

• OpenIdentityPlatform OpenAM
• Authentication bypass

Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration

• NASA-AMMOS AIT-Core
• Authentication bypass

MLS X.509 credential not bound to the LeafNode signature key

• Legion of the Bouncy Castle Inc. BC-JAVA
• Authentication bypass
• Weak cryptography or TLS

Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'

• burstbv Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)
• Authentication bypass

TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

• TillKit
• Authentication bypass

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

• WP 2FA
• Authentication bypass

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

• Authentication bypass
• CWE-1385

<0.35.0 · fixed in 0.35.0

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

• Information disclosure
• Authentication bypass

>=0.1.0, <0.1.7 · fixed in 0.1.7

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

• Authentication bypass

<4.5.5 · fixed in 4.5.5

Missing authentication in Zilliz Attu

• Zilliz Attu
• Authentication bypass

Monta monta.app Missing Authentication for Critical Function

• monta.app
• Authentication bypass

Monta monta.app Improper Restriction of Excessive Authentication Attempts

• monta.app
• Authentication bypass

Monta monta.app Insufficient Session Expiration

• monta.app
• Authentication bypass

UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter

• UTMStack
• Authentication bypass

Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject

• Red Hat Certificate System 10
• Red Hat Certificate System 11
• Authentication bypass

Microsoft Exchange Server Elevation of Privilege Vulnerability

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 14
• Authentication bypass

Missing authentication for critical function in Loom for AWS

• AWS loom
• Authentication bypass
• CWE-1188

onetwothreeneth HospitalManagementSystem sessions.php improper authentication

• onetwothreeneth HospitalManagementSystem
• Authentication bypass

xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

• Fedora
• Red Hat Enterprise Linux 9
• Authentication bypass

User Impersonation/Authorization Bypass in XMPP Server ejabberd

• ProcessOne ejabberd
• Authentication bypass

YesWiki before 4.6.7 Session Fixation via Login in AuthController.php

• yeswiki
• Authentication bypass

YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

• yeswiki
• Authentication bypass

YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

• yeswiki
• Authentication bypass

YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing

• yeswiki
• Authentication bypass

JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

• parorrey JSON API Auth
• Authentication bypass

Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

• Paytm Payment Gateway
• Authentication bypass

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

• DiviEngine Divi Membership
• Authentication bypass

DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

• dplugins DevKit Pro
• Authentication bypass

Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server

• kvcache-ai Mooncake
• Authentication bypass

Missing Authentication in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Authentication bypass

Podgrab Missing Authentication on WebSocket /ws Endpoint

• akhilrex podgrab
• Authentication bypass

Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

• TP-Link Systems Inc. Tapo C200 v5
• TP-Link Systems Inc. Tapo C120 v1
• Authentication bypass

Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200

• TP-Link Systems Inc. Tapo C200 v5
• TP-Link Systems Inc. Tapo C120 v1
• Authentication bypass

Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200

• TP-Link Systems Inc. Tapo C200 v5
• TP-Link Systems Inc. Tapo C120 v1
• Authentication bypass

Foreman: unauthenticated information disclosure via provisioning token validation flaw

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Authentication bypass

Apache HTTP Server: mod_auth_digest one-time-nonce replay attack

• Apache Software Foundation Apache HTTP Server
• Authentication bypass

WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access

• WatchGuard Endpoint Security
• Authentication bypass
• Hard-coded credentials

Apache HTTP Server: mod_auth_digest reauthentication attack

• Apache Software Foundation Apache HTTP Server
• Authentication bypass

WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability

• hCaptcha for WP
• Authentication bypass

HCL iControl is affected by a Session Timeout vulnerability

• HCL Software iControl
• Authentication bypass

Apache APISIX: Openid-connect introspection validation issue

• Apache Software Foundation Apache APISIX
• Authentication bypass

Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

• Ghost
• Authentication bypass

Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

• Ghost
• Authentication bypass

Fleet before 4.87.0 Authentication Bypass via Device Identifiers

• fleet
• Authentication bypass

ground-station before 0.8.0 Authentication Bypass via setup.restore

• sgoudelis ground-station
• Authentication bypass

Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

• Red Hat OpenShift Container Platform 4.18
• Red Hat OpenShift Container Platform 4.19
• Authentication bypass

MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

• MISP
• Authentication bypass

Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter

• superdav42 Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
• Authentication bypass