EUVD-2026-116530

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-121531

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-121531

A vulnerability exists in Umami versions 3.3.x, 3.4.0, and 3.4.1 within the 2FA Policy Handler component. Specifically, an issue in the file src/app/api/auth/login/route.ts allows for manipulation that results in the use of single-factor authentication . This vulnerability can be initiated remote...

CVE-2026-121531 Umami 2FA Policy route.ts single-factor authentication

A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-74760

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-74760 Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-74760

The Google::Auth Perl library (versions 0.11 through 0.12 ) is vulnerable to a local security issue because the gcloud-auth login callback fails to validate the OAuth state parameter. During gcloud-auth login or application-default login commands, the CLI sends a state parameter but fails to comp...

EUVD-2026-114874

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-74760: Origin Validation Error

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

PT-2026-134919

Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then...

CVE-2026-62860

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login throws...

EUVD-2026-114465

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login throws...

CVE-2026-62860 Picsou vulnerable to login timing attack

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login throws...

CVE-2026-62860 Picsou vulnerable to login timing attack

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy. In backend/src/main/java/com/picsou/controller/AuthController.java, AuthController.login throws...

CVE-2026-119662

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119662 Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

EUVD-2026-114078

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119662 Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119662 Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119662

Versions of Songloft from 2.9.0 before 2.13.6 are vulnerable to a hardcoded credentials vulnerability in the embedded backend. Attackers located on the same network can authenticate as an administrator by using the fixed admin/admin pair via the /api/v1/auth/login endpoint. Successful authenticat...