EUVD-2026-101746

Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. Attackers can copy a legitimate provider's OIDC issuer or SAML entity ID and assert a victim'...

EUVD-2026-101747

Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers c...

EUVD-2026-101735

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit...

EUVD-2026-101745

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state ...

RLSA-2026:80512 Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies CVE-2026-6253 curl: libcurl: Authenticatio...

curl security update

An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...

CVE-2026-84731: Missing Authentication for Critical Function

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters...

CVE-2026-110904: Incorrect Authorization

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call...

CVE-2026-105038: Missing Authentication for Critical Function

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...

PT-2026-115116

Name of the Vulnerable Software and Affected Versions Kuadrant operator affected versions not specified Description A flaw exists in the internal WebAssembly WASM shim used by the operator. The shim fails to correctly escape values from HTTPRoute match fields when generating the Common Expression...

UBUNTU-CVE-2026-109750

Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-100351: Authentication Bypass by Alternate Name

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-101287: Reliance on Cookies without Validation and Integrity Checking

Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier userId and the status of the authentication process validSteps in this cookie and relies on these...

CVE-2026-39997: Missing Authentication for Critical Function

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and...

PT-2026-115208

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.2 Description The LINE backend fails to validate the returned OAuth state during the exchange of an authorization code. This allows an attacker to initiate an authorization flow for an account they...

CVE-2026-77711: Exposure of Sensitive Information to an Unauthorized Actor

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

CVE-2026-110746: Improper Limitation of a Pathname to a Restricted Directory

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM...

CVE-2026-109750

Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-111322: Missing Authentication for Critical Function

Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...

Fortinet FortiSandbox 4.4.x < 4.4.10 / 5.0.x < 5.0.7 Authentication Bypass (FG-IR-26-185)

The version of Fortinet FortiSandbox installed on the remote host is 4.4.x prior to 4.4.10 or 5.0.x prior to 5.0.7. It is, therefore, affected by a vulnerability: - An authentication bypass using an alternate path or channel vulnerability CWE-288 in the FortiSandbox GUI may allow a remote...