Authentication bypass.

BillaBear Installation InstallController.php processInstall missing authentication

• BillaBear
• Authentication bypass

Implem Inc. Pleasanter: Pleasanter provided fails to properly verify passwords in LDAP authentication when…

• Implem Inc. Pleasanter
• Authentication bypass

Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

• Apache Software Foundation Apache Camel
• Authentication bypass

777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication

• 777genius agent-teams-ai
• Authentication bypass

nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret

• Payment Gateway
• Authentication bypass

OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

• OPay Payment Gateway for WooCommerce
• Authentication bypass

iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

• Online Payments with iK Pay Gateway
• Authentication bypass

NocoDB signup validatePassword excessive authentication

• NocoDB
• Authentication bypass
• CWE-799

GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication

• GiantappMan LiveWallPaper
• Authentication bypass

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords.

• Authentication bypass

Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

• grokability snipe-it
• Authentication bypass

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses

• parse-community parse-server
• Authentication bypass

Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config

• dqzboy Docker-Proxy
• Authentication bypass

WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

• WP Stripe Checkout
• Authentication bypass

YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication

• YunaiV ruoyi-vue-pro
• zhijiantianya ruoyi-vue-pro
• Authentication bypass
• CWE-799

YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication

• YunaiV ruoyi-vue-pro
• zhijiantianya ruoyi-vue-pro
• Authentication bypass

Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

• Unitree Robotics Unitree Go2
• Authentication bypass
• Weak cryptography or TLS

Forged signed tokens let any registered user take over other users and organizations

• GitroomHQ postiz-app
• Authentication bypass
• Broken access control

asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

• asVereinbase
• Authentication bypass

Laravel TokenGuard authentication bypass through non-string API credentials

• Authentication bypass
• CWE-1287

<12.68.0 || >=13.0.0, <13.29.0 · fixed in 12.68.0, 13.29.0

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

• Authentication bypass
• Hard-coded credentials

>=4.0.0a1, <4.1.2 · fixed in 4.1.2

OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

• open-reception appointment-booking-software
• Authentication bypass

OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie

• open-reception appointment-booking-software
• Authentication bypass

WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

• zephyr
• Authentication bypass
• CWE-346

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

• Authentication bypass

<0.0.0-20260731131820-67bc300b6ea6 · fixed in 0.0.0-20260731131820-67bc300b6ea6

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

• intranda goobi-viewer-core
• Authentication bypass
• Broken access control

Goobi viewer: OpenID JWT audience not enforced by the verifier

• intranda goobi-viewer-core
• Authentication bypass
• CWE-345

Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

• intranda goobi-viewer-core
• Authentication bypass
• CWE-1392

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

• intranda goobi-viewer-core
• Authentication bypass
• Information disclosure

NetBox MCP Server: HTTP transport exposes all NetBox data without authentication

• netboxlabs netbox-mcp-server
• Authentication bypass
• CWE-1059

DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

• DJI CrystalSky ZS600C
• Authentication bypass

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity

• Zimbra Collaboration Suite
• Authentication bypass

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response

• Zimbra Collaboration Suite
• Authentication bypass

Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer

• Zimbra Collaboration Suite
• Authentication bypass

Missing Authentication in CGM CLININET

• CGM CLININET
• Authentication bypass

Authentication Bypass via IP Spoofing in CGM CLININET rsyncd

• CGM CLININET
• Authentication bypass

Missing Authentication in CGM CLININET

• CGM CLININET
• Authentication bypass

Authentication Bypass Vulnerability

• WizLearn Technologies Pte. Ltd. Learning Management System
• Authentication bypass

Improper authentication in ASUS Router

• ASUS Router
• Authentication bypass

Firmware verification vulnerability

• Creative Labs Creative Sound Blaster Katana V2, V2X, SE
• Authentication bypass

Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

• Google Agent Development Kit (ADK) for Java
• Authentication bypass
• CWE-942

Authentication Source Verification Issue in Okta Access Gateway

• Okta Access Gateway
• Authentication bypass
• Broken access control

Authentication Bypass Leading to Server-Side Command Execution

• onPhase Forms
• Authentication bypass

Kiloview E3 NDI Encoder Missing Authentication for Critical Function

• Kiloview E3 Firmware
• Authentication bypass

Kiloview E3 NDI Encoder Insufficient Session Expiration

• Kiloview E3 Firmware
• Authentication bypass

Kiloview E3 NDI Encoder Missing Authentication for Critical Function

• Kiloview E3 Firmware
• Authentication bypass

Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

• Microsoft Azure Kubernetes Configuration Service
• Authentication bypass

AAD App Proxy Elevation of Privilege Vulnerability

• Microsoft Entra application proxy
• Authentication bypass

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass

• openbao
• Authentication bypass

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

• openbao
• Authentication bypass

Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Code injection
• Authentication bypass

Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass leads to Sensitive Information Disclosure in AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass Leading to Remote Code Execution in AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass in the API allows Administrative Access of AOS-10

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass leads to Unauthorized Access in AOS-8

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass

Authentication Bypass Leading to Remote Code Execution in AOS-10

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Authentication bypass