Authentication bypass.

Missing authentication in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Authentication bypass

Unlimited authentication attempts in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Authentication bypass

Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling

• FalkorDB
• Authentication bypass

Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB

• TP-Link Systems Inc. Tapo C325WB v2
• Authentication bypass

Azure App Service Remote Code Execution Vulnerability

• Microsoft Azure App Service for Linux
• Authentication bypass

fast-jwt: Verifier cache accepts expired JWTs without iat.

• Authentication bypass

<6.3.4 · fixed in 6.3.4

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

• Authentication bypass
• CWE-682

<6.3.0 · fixed in 6.3.0

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

• Information disclosure
• Broken access control

<1.7.3 · fixed in 1.7.3

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

• Authentication bypass
• Broken access control

<4.6.78 · fixed in 4.6.78

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

• Information disclosure
• Authentication bypass

<4.6.78 · fixed in 4.6.78

IBM Guardium Data Protection is affected by vulnerability

• IBM Guardium Data Protection
• Authentication bypass

Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

• Zuler Technology DeskIn
• Authentication bypass

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• Authentication bypass

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• Authentication bypass

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• Authentication bypass

Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE

• dromara skyeye
• Authentication bypass

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

• Authentication bypass
• CWE-346

<4.6.78 · fixed in 4.6.78

TVU Networks Receiver/Transceiver Missing Authentication via REST API

• TVU Networks TVU Receiver / Transceiver
• Authentication bypass

TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login

• TVU Networks TVU Receiver / Transceiver
• Authentication bypass

IBM Guardium Data Protection Missing Authentication

• IBM Guardium Data Protection
• Authentication bypass

Authentication Bypass Using an Alternate Path or Channel in Malcolm

• CISA Malcolm
• Authentication bypass

Authentication Bypass by Spoofing in Malcolm

• CISA Malcolm
• Authentication bypass
• Broken access control

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

• Authentication bypass

>=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1 · fixed in 3.0.14

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

• Authentication bypass
• CWE-693

>=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1 · fixed in 3.0.14

Authentication Bypass by Spoofing in Jacamar CI

• Jacamar CI
• Authentication bypass

mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx

• mJobTime
• Privilege escalation
• Authentication bypass

pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php

• ph7software ph7builder
• Authentication bypass

EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

• espocrm
• Authentication bypass

IBM DataPower Gateway Improper Authentication

• IBM DataPower Gateway 10.6CD
• IBM DataPower Gateway 10.6.0
• Authentication bypass

@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

• @fastify/jwt
• Authentication bypass
• CWE-390

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

• Iskratel Innbox
• Command injection
• Authentication bypass

Authentication bypass in multiple products from Frappe Technologies

• Frappe Technologies
• Authentication bypass

Missing authentication in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Authentication bypass

Missing authentication in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Authentication bypass

Missing authentication in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Authentication bypass

Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter

• Ultimate Multisite
• Authentication bypass

Authentication bypass in Brocade Fabric OS

• Brocade Fabric OS
• Authentication bypass

Missing authentication in Brocade Fabric OS

• Brocade Fabric OS
• Authentication bypass

Authentication bypass by spoofing in Brocade Fabric OS

• Brocade Fabric OS
• Authentication bypass

Authentication bypass by spoofing in Brocade Fabric OS

• Brocade Fabric OS
• Authentication bypass

Authentication bypass by spoofing in Brocade Fabric OS

• Brocade Fabric OS
• Authentication bypass

Missing authentication in Brocade Fabric OS

• Brocade Fabric OS
• Authentication bypass

Potential brute force vulnerability due to non-expiring SMS OTPs

• WSO2 Identity Server
• Authentication bypass

AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

• AsyncHttpClient async-http-client
• Authentication bypass
• CWE-757

AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

• AsyncHttpClient async-http-client
• Authentication bypass
• CWE-1275

Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise

• Splunk Enterprise
• Authentication bypass

Payload: Unauthenticated account-lockout denial of service

• Authentication bypass
• CWE-645

<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Payload authentication token field handling issue

• Authentication bypass
• Broken access control

>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

• Authentication bypass

>=0.1.0, <0.5.0 · fixed in 0.5.0

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

• Authentication bypass

>=0.3.0, <0.6.15 || >=0.7.0, <0.7.5 · fixed in 0.6.15, 0.7.5

mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control

• Authentication bypass
• Broken access control

<3.0.0 · fixed in 3.0.0

Backstage: Improper authentication in the OIDC provider

• Authentication bypass

<0.4.20 · fixed in 0.4.20

Blind VXLAN injection into encrypted overlay networks from cluster peer

• Docker Engine
• Docker Engine overlay network driver
• Authentication bypass

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

• Authentication bypass
• CWE-345

>=1.5.0, <1.10.3 · fixed in 1.10.3

Cisco License On-Prem Security Hardening Release

• Cisco License On-Prem
• Authentication bypass

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

• Authentication bypass

<0.0.0-20260625093330-5e90809657c9 · fixed in 0.0.0-20260625093330-5e90809657c9

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

• Apache Software Foundation Apache Jackrabbit
• Authentication bypass

LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass

• LMCache
• Authentication bypass

LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

• LMCache
• Authentication bypass

LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

• LMCache
• Authentication bypass