Authentication bypass.

dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

• dbt-labs dbt-core
• Path traversal
• Information disclosure

LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session

• LDAPAccountManager lam
• Authentication bypass

Missing HelloVerifyRequest cookie validation in the NetX Secure DTLS server

• Eclipse Foundation Eclipse ThreadX NetX Duo
• Authentication bypass
• CWE-406

Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer

• PgBouncer
• Authentication bypass

Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• Authentication bypass

Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718

• LANTRONIX XPress-DR
• LANTRONIX XPress-DR-I
• Authentication bypass

Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting

• Zimbra Collaboration Suite
• Authentication bypass

Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution

• Juniper Networks Junos OS
• Juniper Networks Junos OS Evolved
• Authentication bypass

Junos OS: Unauthorized root command execution when J-Web is enabled

• Juniper Networks Junos OS
• Authentication bypass

Zulip: OpenID Connect authentication ignores the email_verified claim

• zulip
• Authentication bypass

MOVEit Transfer Identity validation flaw in SFTP authentication

• Progress MOVEit Transfer
• Authentication bypass

MOVEit Transfer Access restriction bypass in OAuth authentication

• Progress MOVEit Transfer
• Authentication bypass

MOVEit Transfer OIDC Authentication Replay Vulnerability

• Progress MOVEit Transfer
• Authentication bypass

MOVEit Transfer Authentication bypass in LDAP sign-on

• Progress MOVEit Transfer
• Authentication bypass

MOVEit Transfer Secure Messaging Authentication Bypass

• Progress MOVEit Transfer
• Authentication bypass

NGINX Ingress Controller vulnerability

• F5 NGINX Ingress Controller
• Authentication bypass

NGINX Ingress Controller vulnerability

• F5 NGINX Ingress Controller
• Authentication bypass

NGINX Gateway Fabric vulnerability

• F5 NGINX Gateway Fabric
• Authentication bypass

Gitea second-factor bypass through OpenID identity linking

• Gitea
• Authentication bypass
• CWE-696

Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE

• Report One MyReport Updater
• Authentication bypass

frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints

• fatedier frp
• Authentication bypass

SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API

• pppscn SmsForwarder
• Authentication bypass

NullHub through 2026.5.29 Missing Authentication for /api Management API

• nullclaw NullHub
• Authentication bypass

Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP

• TR7 Cyber Defense Inc. TR7 ASP
• Authentication bypass

WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

• VideoWhisper.com Broadcast Live Video
• Authentication bypass

Improper Multi-Factor Authentication Validation Allows Authentication Bypass

• TSplus Remote Access
• Authentication bypass

Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop

• JTL-Software GmbH JTL-Shop
• Authentication bypass

Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Authentication bypass

Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback

• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
• Authentication bypass

Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook

• Asaas Gateway for WooCommerce
• Authentication bypass

Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices

• TP-Link Systems Inc. HS103 v5
• TP-Link Systems Inc. EP10 v1
• Authentication bypass

Authentication bypass by spoofing in OpenVPN

• OpenVPN
• Authentication bypass
• CWE-158

Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability

• Authentication bypass

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 · fixed in 8.0.32, 9.0.21, 10.0.13

IBM WebSphere Application Server Liberty is affected by an authentication bypass

• IBM WebSphere Application Server - Liberty
• Authentication bypass

Missing Verification of auth_time Claim in auth0.js

• auth0.js
• Authentication bypass

Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

• Omnispace Agora Project
• Authentication bypass

Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

• Finsys dockhand
• Authentication bypass

Active Directory Federation Services (AD FS) Spoofing Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass
• Weak cryptography or TLS

Windows Schannel Spoofing Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass
• CWE-420

Windows Setup and Deployment Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Authentication bypass

Windows Security Account Manager Tampering Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Authentication bypass

Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability

• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 (Server Core installation)
• Authentication bypass

Azure Key Vault Security Feature Bypass Vulnerability

• Microsoft azure_security_keyvault_certificates
• Microsoft azure_security_keyvault_keys
• Authentication bypass

Windows Health and Optimized Experiences Service Elevation of Privilege Vulnerability

• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2
• Authentication bypass

Windows Internet (wininet.dll) Spoofing Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Authentication bypass

Windows Error Reporting Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows Modern Device Management (MDM) Tampering Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Authentication bypass

Active Directory Federation Services (AD FS) Spoofing Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows SmartScreen Tampering Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Authentication bypass

Windows Push Notifications Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Authentication bypass

Windows Remote Access Connection Manager Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability

• Microsoft Windows Server 2019
• Microsoft Windows Server 2019 (Server Core installation)
• Authentication bypass

Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows Kernel Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Active Directory Federation Services (AD FS) Spoofing Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows DHCP Server Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows Print Spooler Components Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass

Windows Projected File System Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Authentication bypass

Network Device Enrollment Service (NDES) Spoofing Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Authentication bypass