Authentication bypass.

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

• open-webui
• Authentication bypass

Improper OAuth token validation in Progress MarkLogic Server

• Progress Software Corporation MarkLogic Server
• Authentication bypass

@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

• @neo4j/graphql
• Authentication bypass

Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller

• Progress ShareFile Storage Zones Controller
• Authentication bypass
• Server-side request forgery (SSRF)

agno-agi agno auth.py get_authentication_dependency missing authentication

• agno
• Authentication bypass

Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication

• OTRS
• OTRS GmbH (former OTRS AG) ((OTRS)) Community Edition
• Authentication bypass

Insufficient Session Revocation for JWT Authentication

• OTRS
• Authentication bypass

Eleveo Call Recording Software logout session expiration

• Eleveo Call Recording Software
• Authentication bypass

Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Authentication bypass

y_project RuoYi Disable API add changeStatus session expiration

• y_project RuoYi
• Authentication bypass

Improper authentication in Samsung Mobile Samsung Flow

• Samsung Mobile Samsung Flow
• Authentication bypass

macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration

• macrozheng mall
• Authentication bypass

AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize

• AmoyLab Unla
• Authentication bypass

Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

• Katanemo Plano
• Authentication bypass

Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send

• Nexting pinclaw
• Authentication bypass

OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces

• OpenAgents
• Authentication bypass

Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

• Disable Users
• Authentication bypass

Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

• Freeton WP
• Authentication bypass

Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

• Mindstien Quick Login
• Authentication bypass

Studio-Saelix Sencho Login Endpoint login improper authentication

• Studio-Saelix Sencho
• Authentication bypass

Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect

• WuKongOpenSource Wukong_HRM
• Authentication bypass

WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability

• DigitalME eRoom
• Authentication bypass

AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

• phoenixthrush AniWorld Downloader
• Authentication bypass

cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing

• chenhg5 cc-connect
• Authentication bypass

AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

• iflytek astron-rpa
• Authentication bypass

Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL

• smp46 pingvin-share-x
• Authentication bypass

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification

• WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
• Authentication bypass

WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

• whyun WPCOM Member
• Authentication bypass

WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability

• Omegathemes Grocery Shopping Store
• Authentication bypass

SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP

• SMS Alert
• Authentication bypass

Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN

• Contest Gallery
• Authentication bypass

Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

• inilerm Advanced IP Blocker
• Authentication bypass

Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field A…

• nasirahmed Advanced Form Integration — Connect Forms to 300+ Apps
• Authentication bypass

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

• Authentication bypass
• Broken access control

>=0.22.0, <=2.6.0 · no fixed version yet

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

• Authentication bypass

>=2.3.0, <2.7.0 · fixed in 2.7.0

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

• Authentication bypass

<2.6.0 · fixed in 2.6.0

Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

• Authentication bypass

<2.6.0 · fixed in 2.6.0

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

• Authentication bypass
• CWE-345

>=1.0.0, <2.4.0 · fixed in 2.4.0

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

• iflytek astron-agent
• Code injection
• Authentication bypass

x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

• duty1g x64dbg-mcp-server
• Authentication bypass

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

• Authentication bypass

>=0.5.0b3.dev1, <=0.5.0b3.dev101 · no fixed version yet

pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

• Authentication bypass

=0.5.0b3.dev101 · no fixed version yet

pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session

• Authentication bypass

<=0.5.0b3.dev101 · no fixed version yet

pyLoad: Api.set_user_permission never invalidates the target's session

• Authentication bypass

>=0.5.0b3.dev98, <=0.5.0b3.dev101 · no fixed version yet

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

• Authentication bypass
• CWE-305

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814 · fixed in 1.9.10-0.20260728074558-95cd21b70814

pyLoad has an authentication bypass in API key validation (check_apikey cache)

• Authentication bypass

<0.5.0b3.dev101 · fixed in 0.5.0b3.dev101

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

• Information disclosure
• Authentication bypass

<0.5.0b3.dev101 · fixed in 0.5.0b3.dev101

Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

• smp46 pingvin-share-x
• Authentication bypass

SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

• Smartertools Smartermail
• Authentication bypass

Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel

• Red Lion Controls 700 Series
• Authentication bypass

Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function

• Red Lion Controls 700 Series
• Authentication bypass

PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

• hotspotbilling phpnuxbill
• Authentication bypass

PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()

• hotspotbilling phpnuxbill
• Authentication bypass

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

• Grid Protection Alliance openPDC
• Grid Protection Alliance openPDC (Docker image)
• Authentication bypass

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

• Grid Protection Alliance openPDC
• Grid Protection Alliance openPDC (Docker image)
• Authentication bypass

WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

• Automattic Jetpack
• Authentication bypass

WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

• Automattic Jetpack
• Authentication bypass

Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

• Apache Software Foundation Apache CXF
• Authentication bypass

WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

• Liquid Web / StellarWP GiveWP
• Authentication bypass

WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

• WPMU DEV Forminator
• Authentication bypass