CWE-1188.

Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation

• Apache Software Foundation Apache OFBiz
• Authentication bypass
• CWE-1188

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagi…

• rubyonrails Active Storage
• CWE-1188

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

• node-opcua
• Broken access control
• CWE-636

Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host

• Temporal Technologies, Inc. Temporal Server
• Command injection
• Broken access control

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page

• CWE-540
• CWE-1188

Authlib RFC 7592 examples omit registration-access-token client binding

• Broken access control
• CWE-1188

>=0.15, <1.9.1 · fixed in 1.9.1

pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• CWE-1188

pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• CWE-1188

pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• CWE-1188

Endpoint credential minting (insecure default allow-list)

• OpenText Advanced Authentication Server
• CWE-1188

xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message

• GuDong2003 xianyu-auto-reply-fix
• CWE-1188

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion

• Denial of service
• CWE-1188

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

• Apache Software Foundation Apache Kafka
• CWE-345
• CWE-1188

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

• Authentication bypass
• CWE-1188

<1.9.0 · fixed in 1.9.0

bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

• Hallo Welt! GmbH BlueSpice
• Privilege escalation
• CWE-1188

Storybook dev server vulnerable to code injection from the local network

• Path traversal
• Code injection

>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6

D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

• dynamics365ninja d365fo-mcp-server
• Authentication bypass
• CWE-1188

Trudesk through 1.2.11 Missing Authentication on Debug Routes

• polonel trudesk
• CWE-1188

A2A Java SDK has a fail-open default task authorization

• Broken access control
• CWE-1188

<1.3.0.Final · fixed in 1.3.0.Final

Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

• letta
• CWE-1188

Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

• coze-dev coze-studio
• CWE-1188

Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend

• CognicellAI Cognition
• Authentication bypass
• CWE-1188

Apache Kylin: default startup profile miss security settings

• Apache Software Foundation Apache Kylin
• CWE-1188

Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

• Google SAM
• Information disclosure
• Authentication bypass

FileRise: Insecure default cryptographic key fallback in manual installs

• error311 FileRise
• Hard-coded credentials
• CWE-1188

holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors

• holaboss-ai holaOS
• CWE-1188

Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration

• moghtech komodo
• CWE-1188

Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL

• Epic Games Unreal Engine
• CWE-1188

MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

• IBM mcp-context-forge
• Authentication bypass
• Hard-coded credentials

Missing authorization check in SAP ABAP Platform

• SAP_SE SAP ABAP Platform
• CWE-1188

Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library

• SAP_SE SAP/cloud-security-services-integration-library
• CWE-1188

sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace

• Th0rgal sandboxed.sh
• CWE-1188

Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

• Dell Secure Connect Gateway (SCG) Policy Manager
• CWE-1188

Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

• Dell Secure Connect Gateway (SCG) Policy Manager
• CWE-1188

Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass

• Obsidian Desktop
• Cross-site scripting (XSS)
• CWE-1188

Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown

• Obsidian Desktop
• Cross-site scripting (XSS)
• CWE-1188

Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise

• Splunk Enterprise
• CWE-1188

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

• CWE-116
• CWE-693

<4.6.78 · fixed in 4.6.78

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

• Path traversal
• CWE-1188

>=2.94.0, <2.132.0 · fixed in 2.132.0

Authenticated SMTP Sender Address Forgery

• OVHcloud
• Authentication bypass
• CWE-346

Missing authentication for critical function in Loom for AWS

• AWS loom
• Authentication bypass
• CWE-1188

Apache Thrift: Perl TLS client disables certificate verification by default

• Apache Software Foundation Apache Thrift
• Weak cryptography or TLS
• CWE-1188

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-130

Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-1188

Johnson Controls EasyIO FS32: : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO…

• Johnson Controls EasyIO FS32
• CWE-1188

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

• CWE-453
• CWE-829

<3.11.7 · fixed in 3.11.7

JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication…

• JetBrains YouTrack
• CWE-1188

Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5

• Anjvision YSSD-RTMP-H5
• CWE-1188

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

• Privilege escalation
• CWE-1188

<41.10.6 || >=42.0.0-alpha.1, <42.9.2 || >=43.0.0-alpha.1, <43.4.1 || >=44.0.0-alpha.1, <44.0.0-beta.5 · fixed in 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5

Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

• Dell Secure Connect Gateway (SCG) Policy Manager
• CWE-1188

Taskview Community Missing Authentication via OAuth Dynamic Client Registration

• Gimanh taskview-community
• CWE-1188

SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

• signoz
• CWE-1188

Apache Tomcat Native: Insecure OpenSSL options enabled

• Apache Software Foundation Apache Tomcat Native
• CWE-1188

Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

• Temporal Technologies, Inc. Temporal Server
• Command injection
• CWE-749

Obot: Server-Side Request Forgery via remote MCP server URL

• Server-side request forgery (SSRF)
• CWE-1188

<0.23.0 · fixed in 0.23.0

Grandstream GWN7660ELR < 1.0.27.6 Information Disclosure via SNMP Default Community String

• Grandstream Networks GWN7660ELR
• CWE-1188

Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

• fuomag9 caddy-proxy-manager
• CWE-1188

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

• Server-side request forgery (SSRF)
• CWE-20

>=6.0.2, <6.7.0 · fixed in 6.7.0

nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default

• nl.nl-portal:app
• Information disclosure
• CWE-1188

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication…

• CWE-1188