CVE-2026-100677

Versions of stoatchat before 0.15.5 are vulnerable to an account enumeration vulnerability within the login endpoint. Unauthenticated attackers can distinguish between registered and unregistered email addresses by analyzing the error location fields returned during POST /api/auth/session/login r...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

EUVD-2026-87650

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

EUVD-2026-87761

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...

CVE-2026-100667

The grav-plugin-login (Grav CMS Login plugin) versions >= 3.8.7 and

CVE-2026-100667 grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...

CVE-2026-100667 grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

grav-plugin-login the Grav CMS Login plugin versions = 3.8.7 and 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated Twig function or the authenticated shortcode. On sites with 2FA enabled, Login::isAuthenticated checked only the session flag...

EUVD-2026-87701

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

CVE-2026-100606

Flowise versions through 3.1.4 (Enterprise/platform mode with SSO enabled) are vulnerable to an authentication bypass in the SSO login path. The root cause lies in verifyAndLogin (SSOBase.ts:80-94 ), which incorrectly copies the database user record—including the server-stored tempToken—into the ...

CVE-2026-100532

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

CVE-2026-100532

The @openclaw/whatsapp (npm) package, in versions prior to 2026.8.1 , contains a vulnerability where the WhatsApp login tool is exposed via the generic channel-tool path. The flaw occurs because the system fails to preserve the originating sender's owner status, leading to a bypass of the owner-o...

CVE-2026-100532 openclaw WhatsApp before 2026.8.1 Authentication Bypass

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

CVE-2026-100532 openclaw WhatsApp before 2026.8.1 Authentication Bypass

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

EUVD-2026-87518

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

CVE-2026-100532

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

EUVD-2026-87367

Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt...

EUVD-2026-87368

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

PT-2026-99348

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5 Description An account enumeration issue exists in the login endpoint. Unauthenticated attackers can identify whether an email address is registered by analyzing the error location fields returned in the...

CVE-2026-100677: Generation of Error Message Containing Sensitive Information

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...