Authentication bypass.

Missing brute-force protection for web interface

• Delta Electronics Delta UFC500
• Authentication bypass

API permission bypass via logic bug

• Teltonika Networks RUT
• Teltonika Networks RUTX
• Authentication bypass

Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

• Security Plugin, Firewall & Malware Scanner with Auto Removal
• Authentication bypass

Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication

• cyberlord92 Page and Post Restriction
• Authentication bypass

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

• Drupal Authenticator Login Plus (2FA)
• Authentication bypass

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

• Drupal Authenticator Login Plus (2FA)
• Authentication bypass

DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237

• Drupal DocCheck Basic
• Authentication bypass

Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248

• Drupal Shield
• Authentication bypass

Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

• Drupal Domain Login Restrict
• Authentication bypass

CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

• Drupal CAPTCHA
• Authentication bypass

OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

• Drupal OAuth Login - OAuth OIDC SSO
• Authentication bypass

OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

• Drupal OpenID Connect Client
• Authentication bypass

Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Authentication bypass

An issue was discovered in Keyfactor EJBCA 9.

• Authentication bypass

Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

• Delinea Privilege Manager
• Weak cryptography or TLS
• Authentication bypass

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

• Authentication bypass

<26.6.4 · fixed in 26.6.4

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

• Information disclosure
• Authentication bypass

>=2.2.0, <3.0.1 · fixed in 3.0.1

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

• Authentication bypass

<6.0.0 · fixed in 6.0.0

Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Authentication bypass
• CWE-308

SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Authentication bypass

Improper Authentication in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Authentication bypass
• Hard-coded credentials

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Authentication bypass

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Authentication bypass

WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

• myCred
• Authentication bypass

WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability

• Hamid Alinia Login with phone number
• Authentication bypass

Missing authentication in Kaspersky Network Agent and others

• Kaspersky Network Agent
• Kaspersky Administration Server
• Authentication bypass

Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter

• Two Factor Authentication
• All-In-One Security (AIOS)
• Authentication bypass

PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass

• PAYCOMET for WooCommerce
• Authentication bypass

Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite

• wild-apricot Wild Apricot Login
• Authentication bypass

SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover

• sslplugins SSL Wireless SMS Notification
• Authentication bypass

Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token

• guruteam Bot for Telegram on WooCommerce
• Authentication bypass

Missing authentication in canva ortto

• canva ortto
• Authentication bypass

The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell.

• Authentication bypass

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

• Authentication bypass

AVideo-Encoder: missing authentication on control and status endpoints

• WWBN AVideo-Encoder
• Authentication bypass
• Broken access control

Waline login accepts a non-string email as a match-all MongoDB query

• Authentication bypass
• Other injection

<1.41.0 · fixed in 1.41.0

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

• Authentication bypass
• CWE-345

<6.2.0 · fixed in 6.2.0

Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

• signalk-server
• Authentication bypass

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

• Authentication bypass

<1.1.36 · fixed in 1.1.36

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

• Authentication bypass

>=4.0.0, <=4.16.2 · no fixed version yet

Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools

• drhelius Gearboy
• Authentication bypass

FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

• fearlessgeekmedia FearlessCMS
• Path traversal
• Cross-site scripting (XSS)

Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events

• WSO2 Identity Server
• WSO2 Carbon OAuth
• Authentication bypass

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

• WSO2 API Manager
• WSO2 Traffic Manager
• Authentication bypass

go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware

• chi
• Authentication bypass

Session fixation in Jenkins

• Jenkins
• Authentication bypass

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

• Apache Software Foundation Apache Kafka
• Authentication bypass

Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

• Juniper Networks Session Smart Router
• Authentication bypass

Missing authentication in pretix

• pretix
• Authentication bypass

Improper authentication in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Authentication bypass

Missing Authentication for Critical Function in Tactis' NoviGest Desktop App

• Tactis NoviGest Desktop App
• Authentication bypass

Weak authentication in Acronis Cyber Protect Cloud Agent and others

• Acronis Cyber Protect Cloud Agent
• Acronis Cyber Protect 17
• Authentication bypass

Authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center

• Dell PowerProtect Data Domain Management Center
• Authentication bypass

Improper authentication in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Authentication bypass

Authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center

• Dell PowerProtect Data Domain Management Center
• Authentication bypass

UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN Secret

• UniPAY Payment Gateway For WooCommerce
• Authentication bypass

Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter

• zorem Customer Email Verification for WooCommerce
• Authentication bypass

Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

• artbees Jupiter X Core
• Authentication bypass

jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication

• jeremyckahn Chitchatter
• Authentication bypass

Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305

• TP-Link Systems Inc. RE305 v3
• Authentication bypass