Authentication bypass.

Authentication bypass in Veeam ONE

• Veeam ONE
• Authentication bypass

Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

• Authentication bypass
• Weak cryptography or TLS

<1.9.1 · fixed in 1.9.1

Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation

• WatchGuard Fireware OS
• Command injection
• Authentication bypass

Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking

• WatchGuard Fireware OS
• Authentication bypass
• CWE-346

Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write

• WatchGuard Fireware OS
• Memory corruption
• Authentication bypass

Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

• WatchGuard Fireware OS
• Authentication bypass
• CWE-345

Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection

• WatchGuard Fireware OS
• Command injection
• Authentication bypass

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

• Authentication bypass
• CWE-807

<1.9.0 · fixed in 1.9.0

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

• Authentication bypass
• CWE-1188

<1.9.0 · fixed in 1.9.0

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

• Authentication bypass
• Race condition

>=1.6.17, <1.7.7 · fixed in 1.7.7

better-auth: OAuth Proxy lets an attacker sign in as another user

• Authentication bypass
• CWE-345

>=1.5.0-beta.12, <1.7.7 · fixed in 1.7.7

better-auth: OAuth state can be used as a Magic Link to sign in as another user

• Authentication bypass

>=1.4.0-beta.18, <1.7.7 · fixed in 1.7.7

3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share

• maz1987in 3Dviewer-Nextcloud
• Authentication bypass
• Broken access control

Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

• TeamViewer Remote Management - Monitoring
• Authentication bypass

OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

• Authentication bypass

>=3.3.0, <4.0.1 · fixed in 4.0.1

Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally

• Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally
• Authentication bypass

OTP Brute-Force Account Takeover in Idvlabs Software's Ontime

• İdvlabs Software and Consulting Services Inc. Ontime
• Authentication bypass

Missing authentication in NVIDIA NeMo Agent Toolkit

• NVIDIA NeMo Agent Toolkit
• Authentication bypass

Missing authentication in Hitachi Energy TRO600 Series Firmware

• Hitachi Energy TRO600 Series Firmware
• Authentication bypass

@fastify/session vulnerable to session revocation bypass via a logout race condition

• @fastify/session
• Race condition
• Authentication bypass

Authentication bypass by replay in Eaton easyE4

• Eaton easyE4
• Authentication bypass

REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

• redaxo core
• Authentication bypass

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

• redaxo core
• Authentication bypass

Authentication Bypass by Spoofing Vulnerability in HiRDB

• Hitachi HiRDB Server Version 10
• Hitachi HiRDB Server Version 9
• Authentication bypass

Missing Authentication for Critical Function Vulnerability in HiRDB

• Hitachi HiRDB Server Version 10
• Hitachi HiRDB Server Version 9
• Authentication bypass

Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3

• Hitachi JP1/Automatic Job Management System 3 - Manager
• Authentication bypass

Authentication bypass by spoofing in twofactor_gauthenticator

• alexandregz twofactor_gauthenticator
• Authentication bypass

Insufficient session expiration in twofactor_gauthenticator

• alexandregz twofactor_gauthenticator
• Authentication bypass

Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

• alexandregz twofactor_gauthenticator
• Authentication bypass

Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login

• Qode Themes Qode Membership
• Authentication bypass

Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability

• SMCI MBD-X12SPI
• Authentication bypass

Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability

• SMCI X12SPI
• Authentication bypass

Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback

• Payment Integration Wompi
• Authentication bypass

Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key

• Payex Payment Gateway for Woocommerce
• Authentication bypass

WebAuthn assertion replay permits second-factor bypass in Psono Server

• esaqa GmbH Psono
• Authentication bypass

SourceCodester Online Food Ordering System delete_admin.php missing authentication

• SourceCodester Online Food Ordering System
• Authentication bypass

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

• yeswiki
• Authentication bypass

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

• openpanel
• Authentication bypass

Missing authentication in Apple iOS and iPadOS

• Apple iOS and iPadOS
• Authentication bypass

Authentication bypass by spoofing in Apple macOS

• Apple macOS
• Authentication bypass

Authentication bypass by spoofing in Apple macOS

• Apple macOS
• Authentication bypass

Improper authentication in Apple macOS

• Apple macOS
• Authentication bypass

Authentication bypass by spoofing in Apple macOS

• Apple macOS
• Authentication bypass

Authentication bypass by spoofing in Apple macOS

• Apple macOS
• Authentication bypass

Authentication bypass by spoofing in Apple macOS

• Apple macOS
• Authentication bypass

Improper authentication in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Authentication bypass

Authentication bypass by spoofing in Apple macOS

• Apple macOS
• Authentication bypass

Improper authentication in Apple iOS and iPadOS

• Apple iOS and iPadOS
• Authentication bypass

Unauthorized Access to Internal Web Resources

• WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro
• WolfVision Cynap Pure (Next Gen), Cynap Bridge
• Authentication bypass

OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens

• cheaper-inference OmniRoute
• Authentication bypass

Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset

• padok-team burrito
• Authentication bypass
• Broken access control

Akuvox Akubela HyPanel PS51 login improper authentication

• Akuvox Akubela HyPanel PS51
• Authentication bypass

Missing Authentication for Critical Function in boneIO

• boneIO
• Authentication bypass

Improper Restriction of Excessive Authentication Attempts in boneIO

• boneIO
• Authentication bypass

Missing Authentication in Default Configuration in boneIO

• boneIO
• Authentication bypass

Missing Authentication for Node-RED in boneIO

• boneIO
• Authentication bypass

Authentication bypass in Fortinet FortiSandbox and others

• Fortinet FortiSandbox
• Fortinet FortiSandbox PaaS
• Authentication bypass

danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

• huangxd- danmu_api
• Authentication bypass

Improper Authentication Vulnerability in CreditNirvana Collections Platform

• CreditNirvana Collections Platform (CollectionWorkz)
• Authentication bypass

Authentication bypass by replay in Siemens Mendix SAML (Mendix 10 compatible) and others

• Siemens Mendix SAML (Mendix 10 compatible)
• Siemens Mendix SAML (Mendix 11 compatible)
• Authentication bypass