CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105213

ZITADEL versions 4.x before 4.17.1 are vulnerable to an authentication bypass due to a failure in the Login V2 authentication process. The system fails to verify if an organization is in an inactive state, checking only the individual user's status. Consequently, users belonging to a deactivated ...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes...

CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes...

CVE-2026-105211

ZITADEL versions before 4.17.1 are vulnerable to an authentication bypass in Login V2 . This flaw allows unauthenticated attackers to intercept OTP codes delivered via the returnCode delivery type. By knowing a victim's login name who has OTP-Email and OTP-SMS enrolled, an attacker can read both ...

CVE-2026-105211 ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes...

EUVD-2026-92103

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 are vulnerable to a missing authentication flaw in the hosted Login V1 UI . The root cause is that second-factor enrollment and initialization handlers process requests on an identify-only session before the primary factor is verified. An a...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105210 ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105208 ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent...

CVE-2023-44812

CVE-2023-44812 ثغرة من نوع XSS المنعكسة Reflected Cross-Site Scripting في معامل adminredirecturl في دالة تسجيل الدخول للمستخدم في mooSocial الإصدار 3.1.8، والتي تسمح للمهاجمين بسرقة ملفات تعريف الارتباط الخاصة بالمشرف وانتحال حسابه عبر رابط مصمم خصيصًا. المعامل المصاب: adminredirecturl الاستغلال ...

CVE-2017-14980_syncbreeze_10.0.28_bof

استغلال - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 يحتوي هذا المستودع على استغلال تجاوز سعة المخزن المؤقت BOF كدليل على المفهوم لـ Sync Breeze Enterprise الإصدار 10.0.28، ويستهدف الثغرة المعروفة باسم CVE-2017-14980. الوصف توجد الثغرة بسبب التحقق غير السليم من الإدخال عند معالجة حقل passwo...

ScreenConnect-UserEnum

ScreenConnect-UserEnum ConnectWise المعروف أيضًا باسم ScreenConnect لديه ثغرة userenum. هذه أداة تعداد للمستخدمين لهذه الثغرة. CVE-2019-16516 الإصدارات المعرضة للخطر = 19.2.24707 ??? لم أفهم حقًا إذا تم إصلاحها في الإصدارات الأعلى...

CVE-2024-48644

CVE-2024-48644 سبتمبر 2024 تفاصيل CVE CVE: https://vulners.com/cve/CVE-2024-48644 NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-48644 Tenable: https://www.tenable.com/cve/CVE-2024-48644 تعداد الحسابات وحسابات المستخدمين القابلة للتخمين ملخص ثغرة تعداد الحسابات في مكون تسجيل الدخول لكاميرا Reolin...

ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227

ABO.CMS-EXPLOIT-Unauthenticated-Login-Bypass-CVE-2024-25227 CVE-2024-25227 إكسبلويت CVE-2024-25227 هي ثغرة SQLi في ABO.CMS 5.8 اكتُشفت في المعامل "tblogin" PoC: POST /login.aspx HTTP/1.1 Host: localhost Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

prepos-login-checker

prepos-login-checker Python 2.7 الميزات مدقق تسجيل دخول الحسابات حفظ النتائج المميزة فقط اشترِ لي قهوة : بيتكوين $: 14nXhmRiQx5joCXFTdR8ydm3T8et7MFDXC كيفية التشغيل؟ أنشئ ملف list.txt أو أي ملف بصيغة txt صيغة القائمة url:user:pass ثبّت Python 2.7 حمّل من هنا python file.py إخلاء مسؤولية !!! لقد...