CWE-1188.

phpMyFAQ: Default Empty API Token Authentication Bypass

• CWE-1188

<4.1.3 · fixed in 4.1.3

Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS

• Information disclosure
• CWE-1188

<1.17.7 · fixed in 1.17.7

Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication

• Information disclosure
• Authentication bypass

<1.17.7 · fixed in 1.17.7

Algernon: Single-file mode unconditionally enables debug mode

• Information disclosure
• CWE-489

<1.17.7 · fixed in 1.17.7

Auth Proxy IPv6 whitelist bypass

• Grafana OSS
• CWE-1188

AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection

• antSword
• Cross-site scripting (XSS)
• Code injection

Insecure Default Initialization in API Authentication leads to Authentication Bypass

• Pandora FMS
• CWE-1188

Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server

• Schneider Electric EcoStruxure™ Panel Server
• CWE-1188

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.

• Siemens SIMATIC HMI MTP1000 Unified Comfort Panel
• Siemens SIMATIC HMI MTP1000 Unified Comfort Panel hygienic
• CWE-1188

PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

• Authentication bypass
• Information disclosure

>=2.5.6, <4.6.34 · fixed in 4.6.34

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

• Cross-site scripting (XSS)
• CWE-116

<=0.0.0-20260421031503-96dfe0bea474 · no fixed version yet

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

• Cross-site scripting (XSS)
• Code injection

<0.0.0-20260512140701-d7b77d945e0d · fixed in 0.0.0-20260512140701-d7b77d945e0d

Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed

• CWE-1188

<2026.4.15 · fixed in 2026.4.15

Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler

• givanz Vvveb
• Information disclosure
• CWE-1188

HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only

• HCL Software BigFix Service Management (SM)
• CWE-1188

BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE

• BridgeHead Software FileStore
• Hard-coded credentials
• CWE-1188

New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

• Broken access control
• CWE-345

<0.12.10 · fixed in 0.12.10

Insecure Default Configuration in P4 Server

• Perforce Helix Core Server (P4D)
• CWE-1188

Gitea has insecure default SSH settings

• Weak cryptography or TLS
• CWE-1188

<1.25.0 · fixed in 1.25.0

engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection

• Authentication bypass
• Cross-site request forgery (CSRF)

<2.0.2 · fixed in 2.0.2

silex technology, Inc. SD-330AC: Initialization of a resource with an insecure default vulnerability exists in SD-330AC…

• silex technology, Inc. SD-330AC
• silex technology, Inc. AMC Manager
• CWE-1188

OpenClaw: Feishu webhook and card-action validation now fail closed

• Authentication bypass
• CWE-1188

<2026.4.15 · fixed in 2026.4.15

OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

• Broken access control
• CWE-1188

<2026.4.10 · fixed in 2026.4.10

OpenClaw: Browser SSRF policy default allowed private-network navigation

• Server-side request forgery (SSRF)
• CWE-1188

<2026.4.14 · fixed in 2026.4.14

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

• Authentication bypass
• Broken access control

<2026.410.0 · fixed in 2026.410.0

Initialization of a resource with an insecure default in OpenPLC_V3

• OpenPLC_V3
• CWE-1188

openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools

• Broken access control
• CWE-1188

<2.0.0 · fixed in 2.0.0

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

• Server-side request forgery (SSRF)
• CWE-1188

<3.33.4 · fixed in 3.33.4

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

• Information disclosure
• CWE-501

>=39.0.0-alpha.1, <39.8.0 || >=40.0.0-alpha.1, <40.7.0 || >=41.0.0-alpha.1, <41.0.0-beta.8 · fixed in 39.8.0, 40.7.0, 41.0.0-beta.8

DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost

• CWE-1188

<1.4.0 · fixed in 1.4.0

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default.

• NVIDIA Jetson Xavier Series and Jetson Orin Series
• CWE-1188

Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config in github.com/traefik/traefik

• Authentication bypass
• CWE-179

* · no fixed version yet

Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability

• CWE-1188

* · no fixed version yet

FileRise: Default Encryption Key Enables Token Forgery and Config Decryption

• error311 FileRise
• Hard-coded credentials
• CWE-1188

WWBN AVideo has predictable default admin credentials in official Docker deployment path

• WWBN AVideo
• CWE-1188

AnythingLLM Permissable CORS policy

• Mintplex-Labs anything-llm
• CWE-942
• CWE-1188

Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments

• himmelblau
• CWE-1188

@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection

• Command injection
• Authentication bypass

<1.25.0 · fixed in 1.25.0

Mongoose Web Server 6.9 Denial of Service via Socket Connection

• Cesanta Mongoose Web Server
• CWE-1188

AMPPS 2.7 Denial of Service via Malformed Socket Connection

• AMPPS
• CWE-1188

Microsoft ACI Confidential Containers Information Disclosure Vulnerability

• Microsoft ACI Confidential Containers
• CWE-1188

Unauthenticated RCE via SNMP Default Writable Community String

• International Datacasting Corporation (IDC) SFX2100 Series SuperFlex SatelliteReceiver
• CWE-1188

OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container

• CWE-693
• CWE-1188

<2026.2.21 · fixed in 2026.2.21

UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a craf…

• CWE-1188

Beetel 777VR1 Telnet Service/SSH Service insecure default initialization of resource

• Beetel 777VR1
• CWE-1188

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

• Authentication bypass
• CWE-749

<2.5.27 || >=2.6.0, <2.6.10 · fixed in 2.5.27, 2.6.10

Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key

• brstefanovic Advanced Country Blocker
• CWE-1188

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

• Hard-coded credentials
• CWE-1188

<1.2.10 · fixed in 1.2.10

FUXA contains an insecure default configuration vulnerability

• Authentication bypass
• CWE-1188

<=1.2.7 · no fixed version yet

terraform-provider-proxmox has insecure sudo recommendation in the documentation

• Path traversal
• CWE-1188

<0.93.1 · fixed in 0.93.1

Unauthenticated SOAP API in dormakaba access manager

• dormakaba Access Manager 92xx-k5
• dormakaba Access Manager 92xx-k7
• Authentication bypass
• CWE-1188

Unauthenticated SOAP API in dormakaba Kaba exos 9300

• dormakaba Kaba exos 9300
• Authentication bypass
• CWE-1188

Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer

• CWE-1188

>=1.5.0 || >=1.6.0 · no fixed version yet

Stored Cross-site Scripting (XSS) in Kentico Xperience 13

• Kentico Xperience
• Cross-site scripting (XSS)
• CWE-1188

Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration

• CWE-1188

Initialization of a Resource with an Insecure Default in YAOOK

• ALASCA YAOOK
• CWE-1188

Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

• Authentication bypass
• CWE-1188

>=2025.9.1, <2025.12.0-alpha.2 · fixed in 2025.12.0-alpha.2

Japan Total System Co.,Ltd. GroupSession Free edition: In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1…

• Japan Total System Co.,Ltd. GroupSession Free edition
• Japan Total System Co.,Ltd. GroupSession byCloud
• CWE-1188

In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value.

• Google Android
• CWE-1188

In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default.

• Google Android
• CWE-1188