Authentication bypass.

@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

• @fastify/oauth2
• Cross-site request forgery (CSRF)
• Authentication bypass

satya-vinay Events-Management-System missing authentication

• satya-vinay Events-Management-System
• Authentication bypass

Stackrox: stackrox: saml response replay allows multiple central authentication tokens

• Red Hat Advanced Cluster Security for Kubernetes 4.10
• Red Hat Advanced Cluster Security for Kubernetes 4.11
• Authentication bypass

TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation

• TufayelLUS TikTok-Video-Downloader-PHP
• Authentication bypass
• Weak cryptography or TLS

Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

• Apache Software Foundation Apache Camel
• Authentication bypass

Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse

• Apache Software Foundation Apache Camel
• Authentication bypass

GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation

• GlitterWare Passy
• Authentication bypass
• Weak cryptography or TLS

Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors

• Apache Software Foundation Apache Camel
• Authentication bypass

eremef bandcamp-player Remote Control Server database.ts missing authentication

• eremef bandcamp-player
• Authentication bypass

f3-factory fatfree-core HTTP Client web.php _curl certificate validation

• f3-factory fatfree-core
• Authentication bypass
• Weak cryptography or TLS

Apache Answer: Reaction API authorization bypass for restricted content

• Apache Software Foundation Apache Answer
• Authentication bypass

Apache Answer: User Center integration does not revoke first-login sessions after central account suspension

• Apache Software Foundation Apache Answer
• Authentication bypass

Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation

• Apache Software Foundation Apache Answer
• Authentication bypass

Apache Kylin: unauthenticated broadcast API and polymorphic deserialization

• Apache Software Foundation Apache Kylin
• Authentication bypass

check_hba_replication 认证与访问控制绕过

• openGauss-server
• Authentication bypass

dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication

• dotnet eShop
• Authentication bypass

Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

• Google SAM
• Information disclosure
• Authentication bypass

Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

• Google SAM
• Authentication bypass
• Broken access control

diem-project diem Google Analytics Client gapi.class.php certificate validation

• diem
• Authentication bypass
• Weak cryptography or TLS

Gitea SSH certificate principal impersonation of other users

• Gitea
• Authentication bypass

Gitea OpenID account linking without session binding

• Gitea
• Authentication bypass
• Cross-site request forgery (CSRF)

@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults

• @fastify/jwt
• Authentication bypass

Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files

• Netcore NR256CN
• Authentication bypass

Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

• vanus
• Authentication bypass

OpenCATS Career Portal CareersUI.php processLogin excessive authentication

• OpenCATS
• Authentication bypass
• CWE-799

itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication

• itsmeravitejak Online-Examination-System
• Authentication bypass

phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

• thorsten phpMyFAQ
• Authentication bypass

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking

• thorsten phpMyFAQ
• Authentication bypass

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

• thorsten phpMyFAQ
• Authentication bypass

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints

• thorsten phpMyFAQ
• Authentication bypass

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint

• thorsten phpMyFAQ
• Authentication bypass

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks

• thorsten phpMyFAQ
• Authentication bypass

Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
• Authentication bypass

OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation

• tinyhumansai openhuman
• Cross-site request forgery (CSRF)
• Authentication bypass

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

• Authentication bypass
• Insecure deserialization

>=0.3.9, <0.5.6 · fixed in 0.5.6

Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

• Apache Software Foundation Apache Kylin
• Authentication bypass

Apache Kylin: Unauthenticated Metastore Cleanup

• Apache Software Foundation Apache Kylin
• Authentication bypass

IBM i is Affected By An Improper Authentication Vulnerability in SST / DST

• i
• Authentication bypass

Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query

• roncoo-pay
• Authentication bypass

Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix

• Netcore NR256CN
• Authentication bypass

99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel

• vastxie 99AI
• Authentication bypass

LangChat through commit 2a6285a Missing Authentication on REST API Controllers

• langchat
• Authentication bypass

OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API

• OtterMind Nubase
• Authentication bypass

Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie

• niefy wx-api
• Authentication bypass

qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints

• qiantongtech qKnow
• Authentication bypass

WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header

• wimoor
• Authentication bypass

Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover

• xiaochong0302 course-tencent-cloud
• Authentication bypass

IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints

• Thecosy IceCMS
• Authentication bypass

Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

• safing portmaster
• Authentication bypass

waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint

• wayn111 waynboot-mall
• Authentication bypass

waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

• wayn111 waynboot-mall
• Authentication bypass

Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit

• wayn111 waynboot-mall
• Authentication bypass

53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

• 53AIHub
• Authentication bypass

ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API

• HoshinoSuzumi chronoframe
• Authentication bypass

Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

• l429609201 misaka_danmu_server
• Authentication bypass

Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback

• l429609201 misaka_danmu_server
• Authentication bypass

FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints

• FastapiAdmin
• Authentication bypass

bbs-go through 4.4.6 Account Takeover via Google One Tap Login

• mlogclub bbs-go
• Authentication bypass

NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

• Blair2004 NexoPOS
• Authentication bypass

Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

• Webreaper Damselfly
• Authentication bypass