CWE-345.

pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

• pac4j
• CWE-345

IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area

• IGEL OS 12
• IGEL OS 11
• CWE-345

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

• Race condition
• CWE-345

>=2.3.0, <2.3.3 || >=2.4.0-rc.0, <2.4.0-rc.1 · fixed in 2.3.3, 2.4.0-rc.1

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the co...

• CWE-345

<1.4.9 · fixed in 1.4.9

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can ...

• CWE-345

<1.4.9 · fixed in 1.4.9

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

• CWE-345

>=0.22.0, <0.22.5 · fixed in 0.22.5

Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

• Apache Software Foundation Apache Hive
• Authentication bypass
• CWE-305

joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

• authlib joserfc
• Authentication bypass
• CWE-345

Insufficient verification of data authenticity in Devolutions Remote Desktop Manager

• Devolutions Remote Desktop Manager
• CWE-345

Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

• CWE-345

* · no fixed version yet

WWBN AVideo Authorization Bypass via Users_affiliations add.json.php

• WWBN AVideo
• CWE-345

Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer

• Basekick-Labs arc
• Authentication bypass
• CWE-345

Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

• Basekick-Labs arc
• Path traversal
• CWE-345

Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

• Charitable
• CWE-345

myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED

• myCred
• CWE-345

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

• CWE-345

<0.37.8 || >=0.38.0, <0.39.6 || >=0.40.0, <0.42.1 || >=0.43.0, <0.48.0 · fixed in 0.37.8, 0.39.6, 0.42.1, 0.48.0

Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses

• Red Hat Advanced Cluster Management for Kubernetes 2.16
• Red Hat Advanced Cluster Management for Kubernetes 2.17
• CWE-345

Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack

• Red Hat Advanced Cluster Management for Kubernetes 2.16
• Red Hat Advanced Cluster Management for Kubernetes 2.17
• CWE-345

Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

• CWE-345

>=0.3.0 · no fixed version yet

EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution

• emqx
• CWE-345
• CWE-672

Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

• coturn
• CWE-345
• CWE-924

Triton VM Soundness Vulnerability due to Missing Constraint

• CWE-345

>=0.42.0-alpha.4, <4.0.0 · fixed in 4.0.0

BetterDesk has a replay behavior vulnerability when devices are deleted

• UNITRONIX BetterDesk
• Authentication bypass
• CWE-345

Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution

• notepad-plus-plus
• Command injection
• CWE-345

Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

• Open redirect
• CWE-345

<5.1.6 · fixed in 5.1.6

Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

• Kong Inc. Kong Mesh
• Broken access control
• CWE-345

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment va...

• CWE-345

<1.4.0 · fixed in 1.4.0

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private n...

• CWE-345

<1.4.0 · fixed in 1.4.0

Trigger.dev: Cross-tenant payload poisoning via packet write + replay

• triggerdotdev trigger.dev
• Path traversal
• Broken access control

WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

• rtCamp Log in with Google
• CWE-345

PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext

• PostgreSQL
• CWE-313
• CWE-345

Potential package cache integrity issue in JFrog Artifactory

• jfrog artifactory
• CWE-345

Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch

• Estatik Real Estate Plugin
• CWE-345

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configuration and cryptographic details.

• CWE-345

Azure Entra ID Spoofing Vulnerability

• Microsoft Entra
• CWE-345

Insufficient verification of data authenticity in Intel(R) Trust Domain Extensions (Intel(R) TDX)

• Intel(R) Trust Domain Extensions (Intel(R) TDX)
• CWE-345

OpenSignLabs OpenSign - Insufficient Verification of Data Authenticity

• OpenSign
• CWE-345

CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature

• usmannasir cyberpanel
• CWE-345

Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

• Red Hat Multicluster Global Hub 1.4.9
• Red Hat Multicluster Global Hub 1.5.8
• CWE-345

Insufficient verification of data authenticity in Samsung Mobile Smart Switch

• Samsung Mobile Smart Switch
• CWE-345

Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

• Nexter Blocks
• CWE-345

Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum

• klever-io klever-go
• Weak cryptography or TLS
• CWE-345

Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning

• aehrc pathling
• Server-side request forgery (SSRF)
• CWE-20

Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

• Simple CAPTCHA with Cloudflare Turnstile
• CWE-345

Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token

• Subscriptions for WooCommerce
• CWE-345

WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

• WP Events Manager
• CWE-345

RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification

• RegistrationMagic
• CWE-345

Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR

• Five Star Restaurant Reservations
• Broken access control
• CWE-345

Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

• Simple Membership
• CWE-345

Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions

• GitroomHQ postiz-app
• CWE-345

GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification

• GetPaid
• CWE-345

WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification

• WP Travel Engine
• CWE-345

WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass

• WP Hotel Booking
• CWE-345

Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity

• InstaKNXServiceApp
• CWE-345

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

• Authentication bypass
• CWE-178

<2.11.51 · fixed in 2.11.51

Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status

• Formidable Forms
• CWE-345

Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse

• Integrate PhonePe with WooCommerce
• Broken access control
• CWE-345

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

• CWE-345

<=1.7.34 · no fixed version yet

RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

• RealHomes Memberships
• Broken access control
• CWE-345

Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters

• Apache Software Foundation Apache CXF
• CWE-345