CWE-287
CVEs classified under CWE-287, newest first.
775 CVEsRSS
CVE-2026-114509Critical· 9.2PoCLaravel TokenGuard authentication bypass through non-string API credentials
Laravel TokenGuard authentication bypass through non-string API credentials
CVE-2026-56837High· 8.6PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup onl…
CVE-2026-56836High· 8.2PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe …
CVE-2026-97785Critical· 10.0AAD App Proxy Elevation of Privilege Vulnerability
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-115333Medium· 5.9Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain a…
CVE-2026-111958High· 7.5Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authenticated as the token's owning user, an administrator in the defaul…
CVE-2026-114222Medium· 6.2NewType Infortech｜NT OneAPP - Authentication Bypass
NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user.
CVE-2026-114639High· 8.7Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool…
CVE-2026-114638High· 8.7Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision
Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certifi…
CVE-2026-114439High· 7.3oretnom23 php-travel-agency-system Session session.php missing authentication
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id c…
CVE-2026-114438Medium· 4.2Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-fa…
CVE-2026-114261High· 7.3MomoTommy file-management-system Files API FileController.php destroy missing authentication
A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. This issue affects the function index/store/update/destroy of the file app/Http/Controllers/FileController.php of the component Files…
CVE-2026-76474Critical· 9.8Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm…
CVE-2026-114260Medium· 6.5PoCoretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipula…
CVE-2026-114248Medium· 5.3PoCdhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication
A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan…
CVE-2026-86249NoneApache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking …
CVE-2026-48830NoneApache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive conn…
CVE-2026-111955Medium· 6.5WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass
The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass th…
CVE-2026-111949High· 7.5miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add thei…
CVE-2026-96901Low· 3.7Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attacke…
CVE-2026-93744Medium· 6.5IBM i Improper Authentication
IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to a…
CVE-2026-113682High· 7.4Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password
Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated attackers to log in as LDAP/AD-delegated users. Attackers can send a Basic Authorization header wi…
CVE-2026-113469High· 7.5Improper Signature Verification of Active Update Files
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
CVE-2026-105949High· 8.8Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(…
CVE-2026-111090High· 7.8Improper Signature Verification of Firmware Update Files
A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automati…
CVE-2026-107400High· 8.8Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.
CVE-2026-105814Medium· 5.3Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to …
CVE-2026-105815High· 7.1Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an adm…
CVE-2026-112775High· 7.5Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's em…
CVE-2026-107186High· 8.6Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse
An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run workflow rule. This allows for workflow rules to be run without authentication.