Authentication bypass.

LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

• LMCache
• Authentication bypass

Authenticated SMTP Sender Address Forgery

• OVHcloud
• Authentication bypass
• CWE-346

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

• Authentication bypass
• Weak cryptography or TLS

<4.6.78 · fixed in 4.6.78

PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

• Authentication bypass
• Broken access control

<4.6.78 · fixed in 4.6.78

wger: API credentials remain valid after logout/password change

• Authentication bypass

<=2.1 · no fixed version yet

Authentication bypass in Sungrow iSolarCloud

• Sungrow iSolarCloud
• Authentication bypass

MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

• MISP
• Authentication bypass

Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass

• ExpressGateway express-gateway
• Authentication bypass

Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests

• Red Hat Satellite 6
• Authentication bypass

Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transport

• Authentication bypass

>=0.3.9 · no fixed version yet

Apache YuniKorn: Admission control bypass via system label forgery

• Apache Software Foundation Apache YuniKorn
• Authentication bypass

Apache Impala: Impala Executor Webserver Auth Bypass

• Apache Software Foundation Apache Impala
• Authentication bypass

FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

• Flexera FlexNet Publisher
• Authentication bypass

wolfSSHd on Windows race condition leading to logon token reused across connections

• wolfSSL wolfSSH
• Authentication bypass

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.

• Authentication bypass

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.

• Authentication bypass

Gitea OAuth2 refresh token grant accepts access tokens

• Gitea
• Authentication bypass

Security Advisory 0190

• Arista Networks CloudVision CUE
• Authentication bypass
• Hard-coded credentials

Security Advisory 0190

• Arista Networks CloudVision CUE
• Authentication bypass

Gitea WebAuthn bypass during OAuth and OIDC sign-in

• Gitea
• Authentication bypass

Gitea installer authentication bypass for existing accounts

• Gitea
• Authentication bypass

Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in ClearPass Policy Manager

• Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
• Authentication bypass

Authentication Bypass Vulnerabilities in ClearPass Policy Manager

• Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
• Authentication bypass

Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access

• Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
• Authentication bypass

Authentication Bypass Vulnerability in the Management Interface of AOS-S

• Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)
• Authentication bypass

CVE-2026-106511

• MultiversX Labs S.R.L. multisig-improved
• Authentication bypass
• Broken access control

Authentication bypass by replay in Devolutions Server

• Devolutions Server
• Authentication bypass

Authentication bypass by replay in Devolutions Server

• Devolutions Server
• Authentication bypass

Missing authentication in Dell Container Storage Modules

• Dell Container Storage Modules
• Authentication bypass

Missing authentication in Dell Container Storage Modules (CSM)

• Dell Container Storage Modules (CSM)
• Authentication bypass

Missing authentication in Dell Container Storage Modules

• Dell Container Storage Modules
• Authentication bypass

Missing authentication in Dell Container Storage Modules (CSM)

• Dell Container Storage Modules (CSM)
• Authentication bypass

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

• kvcache-ai Mooncake
• Authentication bypass

Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service

• kvcache-ai Mooncake
• Authentication bypass

PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

• planka
• Authentication bypass

WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability

• Ben Marshall Zero Spam
• Authentication bypass

WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability

• WebFactory Advanced Google reCAPTCHA
• Authentication bypass

WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability

• WebFactory Login Lockdown
• Authentication bypass

WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

• Nicu Micle Simple JWT Login
• Authentication bypass

WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

• Captcha by BestWebSoft
• Authentication bypass

WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

• Iqonic Designs Graphina – Charts and Graphs For Elementor
• Authentication bypass

Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.8
• Authentication bypass

UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

• Cloud Foundry UAA
• Cloud Foundry cf-deployment
• Authentication bypass

Missing authentication for critical function in the aas-edge-client REST API

• Murrelektronik Software AAS Edge Client all versions
• Authentication bypass

Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return

• Deema Payment Gateway
• Authentication bypass

Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook

• Deema Payment Gateway
• Authentication bypass

WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

• WP Migration Plugin DB & Files – WP Synchro
• Authentication bypass

SourceCodester Drug Recommendation System Auth Guard improper authentication

• SourceCodester Drug Recommendation System
• Authentication bypass

OSSRS srs System API api.go systemAPI.Run missing authentication

• srs
• Authentication bypass

Filament: Multi-factor authentication (app) management actions do not require password reauthentication

• Authentication bypass

>=4.0.0, <4.13.3 || >=5.0.0, <5.8.3 · fixed in 4.13.3, 5.8.3

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

• Authentication bypass
• CWE-348

>=1.1.0, <2.0.8 · fixed in 2.0.8

Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

• laurent22 joplin
• Authentication bypass
• Weak cryptography or TLS

CVE-2026-82988

• Viewsonic vCast
• Authentication bypass
• Unrestricted file upload

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

• Authentication bypass

>=1.7.0, <1.9.1 · fixed in 1.9.1

Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional

• Red Hat Multicluster Engine for Kubernetes
• Authentication bypass

Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access

• penpot
• Authentication bypass

Maestro: maestro: rest api write endpoints registered without authentication middleware

• Red Hat Multicluster Engine for Kubernetes
• Authentication bypass

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

• plane
• Authentication bypass

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

• plane
• Information disclosure
• Authentication bypass

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

• plane
• Authentication bypass