CVE-2026-111283 BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...

CVE-2026-104198

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

EUVD-2026-98753

Gotify: Insufficiently Protected Password Change endpoint...

EUVD-2026-97907

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools...

GHSA-WQ4W-VWVQ-Q3X9 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Summary Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again. Details GenerateShortToken creates an AuthTok...

EUVD-2026-97864

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable...

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

GHSA-2GC7-J998-5XX6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

EUVD-2026-97865

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover...

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did...

django-auth0-user (>=0.15.0, <=0.16.5), django-rest-social-email-allauth (0.1.0) +6 more potentially affected by CVE-2026-62322 via social-auth-core (3.4.0)

social-auth-core PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - django-auth0-user =0.15.0, =3.0.0, =4.4.0a1, =0.2.0, =2.0.0, =0.0.5, =1.0.2 - social-auth-mitxpro 0.1.0 Source cves:...

GHSA-526J-582W-7FM9 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did...

CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-104198

ZoneMinder versions 1.34.0 through 1.36.38 are vulnerable to a web authentication bypass in web/includes/auth.php. The validateToken() function returns false for malformed or invalid tokens, but the system incorrectly assigns this boolean value to the global $user variable. Since web/index.php on...

CVE-2026-104198 ZoneMinder failed token handling bypasses web authentication

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-104198

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken returns false when a token is malformed or has an invalid signature, but the calle...

CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass

CVE-2026-1729 - AdForest WordPress Authentication Bypass PoC Description Simple Proof of Concept for CVE-2026-1729 PoC - Authentication bypass vulnerability in AdForest WordPress Theme. Authored by f3ds cr3w est 2oo2 blog Features ✅ Direct admin access without credentials ✅ Works on production...

CVE-2026-108334

A flaw was found in the internal WebAssembly WASM shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create o...