Authentication bypass.

Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs

• Umbraco-CMS
• Authentication bypass

Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance

• joey-zhou xiaozhi-esp32-server-java
• Authentication bypass

WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

• MGdaasLab WHartTest
• Authentication bypass

AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test

• alldata
• Authentication bypass

Dockhand: Unauthenticated container exec via WebSocket upgrade

• Finsys dockhand
• Authentication bypass
• Broken access control

J4Care dcm4che Missing Authentication for Critical Function

• J4Care dcm4chee-arc-light
• Authentication bypass

J4Care dcm4che Missing Authentication for Critical Function

• J4Care dcm4chee-arc-light
• Authentication bypass

Apache Kylin: Missing authentication on certain cache API endpoints

• Apache Software Foundation Apache Kylin
• SQL injection
• Authentication bypass

ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation

• Authentication bypass
• CWE-636

Published by the maintainers · not yet reviewed by GitHub

>=v3.7.0-ea.1, <=v3.7.14 · fixed in v3.7.15

Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials

• manuelgalan Vulnity Security
• Authentication bypass

OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

• OTP Login & Register Woocommerce
• Authentication bypass

Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token

• Salon Booking System
• Authentication bypass

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

• cyberlord92 miniOrange OTP Login, Verification and SMS Notifications
• Authentication bypass

Authentication bypass in Lenovo Idea Tab Pro (TB373FU) and others

• Lenovo Idea Tab Pro (TB373FU)
• Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)
• Authentication bypass

MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

• magicblack MacCMS
• Authentication bypass

Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API

• coleam00 Archon
• Authentication bypass

OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

• OpenHealth
• Authentication bypass

Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

• Apache Software Foundation Apache Airflow Keycloak provider
• Authentication bypass

EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching

• EnergizeLab FastAPI AI inference server
• Authentication bypass

EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers

• EnergizeLab NestJS auth service
• Authentication bypass

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

• BeyondTrust Remote Support
• Authentication bypass

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

• Authentication bypass
• Broken access control

<25.4.0 · fixed in 25.4.0

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

• Authentication bypass

<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

• Authentication bypass

<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

• Authentication bypass
• Cross-site request forgery (CSRF)

<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

• Authentication bypass

<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0

ZoneMinder failed token handling bypasses web authentication

• zoneminder
• Authentication bypass
• CWE-697

Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs

• Erudika scoold
• Authentication bypass

joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

• authlib joserfc
• Authentication bypass
• Weak cryptography or TLS

Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS

• Nutanix Acropolis Operating System (AOS)
• Authentication bypass
• CWE-302

authd: Account takeover via username fallback in identity matching after IdP email reassignment

• Canonical authd
• Authentication bypass

Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks

• Lychee
• Authentication bypass

Unitronics - CWE-287: Improper Authentication

• Unitronics UniStream Pro/UniLogic
• Authentication bypass

Authentication bypass by spoofing in Eclipse Foundation Eclipse Connected Services Platform

• Eclipse Foundation Eclipse Connected Services Platform
• Authentication bypass
• CWE-644

Jetty EthereumAuthenticator unanchored login-path matching bypasses authentication and role constraints

• Authentication bypass
• Broken access control

Published by the maintainers · not yet reviewed by GitHub

>=12.1.0, <=12.1.12 · fixed in 12.1.13

Unauthenticated Remote Input Injection in QNAP HD Station's remotepad

• QNAP Systems Inc. HybridDesk Station
• Authentication bypass

Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer

• QNAP Systems Inc. sMedio DTCP MOVE
• Authentication bypass

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

• Hewlett Packard Enterprise HPE NonStop TCP/IP UTILITIES
• Authentication bypass

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

• Hewlett Packard Enterprise HPE NonStop TCP/IP UTILITIES
• Authentication bypass

Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers

• better-auth sso
• Authentication bypass

n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution

• n8n
• Authentication bypass

FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass

• FreeRDP
• Authentication bypass

FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php

• error311 FileRise
• Information disclosure
• Authentication bypass

FileRise OIDC login can bind an attacker identity to an existing local account

• error311 FileRise
• Authentication bypass
• CWE-345

FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

• error311 FileRise
• Authentication bypass
• CWE-841

FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)

• error311 FileRise
• Authentication bypass

FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification

• error311 FileRise
• Authentication bypass
• CWE-620

FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying

• error311 FileRise
• Authentication bypass

FileRise: Login Method Restriction Bypass via Direct API Access

• error311 FileRise
• Authentication bypass

FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

• error311 FileRise
• Information disclosure
• Authentication bypass

FileRise: Remember-me auto-login uses stale admin role from token instead of current role

• error311 FileRise
• Authentication bypass

FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation

• error311 FileRise
• Authentication bypass

FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

• error311 FileRise
• Authentication bypass

OpenAEV has unauthenticated access and missing object-level authorization on player lessons API

• openaev
• Authentication bypass
• Broken access control

WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php

• LabRedesCefetRJ WeGIA
• Information disclosure
• Authentication bypass

cemtan sar2html sar2html.py deleteAll missing authentication

• cemtan sar2html
• Authentication bypass

Sentry: Improper authentication on SAML SSO process allows user identity linking

• sentry
• Authentication bypass

Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force

• databasus
• Authentication bypass

holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist

• holaboss-ai holaOS
• Authentication bypass

Improper Authentication in Multiple TP-Link WiFi Repeaters

• TP-Link Systems Inc. RE190 v5
• TP-Link Systems Inc. RE200 v5
• Authentication bypass