EUVD-2026-91777

A flaw was found in Dogtag PKI pki-core. The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSLCLIENTCERT session attribute retains the EST subsystem's agent certificate, which causes...

CVE-2026-104988

A flaw was found in Dogtag PKI pki-core. The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSLCLIENTCERT session attribute retains the EST subsystem's agent certificate, which causes...

GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

GHSA-8FCF-V89G-XPG6 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

CVE-2026-88010

Traefik (open source HTTP reverse proxy and load balancer) versions 3.6.11 through before 3.7.13 contain an unauthenticated username-enumeration timing oracle in the BasicAuth middleware. The checkPassword function in pkg/middlewares/auth/basic_auth.go constructs the singleflight key from the sub...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-77582

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

CVE-2026-77582

The Tinyauth authentication and authorization server is vulnerable to a user enumeration attack via a timing oracle in versions prior to 5.1.0 . The root cause is located in internal/controller/user_controller.go (loginHandler), internal/middleware/context_middleware.go (basicAuth), and internal/...

CVE-2026-77582 Tinyauth: User enumeration attack by timing oracle

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

CVE-2026-77582: Observable Timing Discrepancy

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

PT-2026-96163

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.1.0 Description Tinyauth exposes a timing difference during authentication attempts that allows a remote observer to distinguish between existing and nonexistent local usernames. This occurs because the loginHandle...

CVE-2026-91973

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

EUVD-2026-78649

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

CVE-2026-91973

Vikunja before 2.6.0 is affected by an authentication bypass in its CalDAV BasicAuth endpoints , which lack rate limiting. Remote unauthenticated attackers can issue unbounded credential-guessing requests against the /dav, /.well-known, and /feeds routes, bypassing the instance's anti-brute-force...

CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...

CVE-2026-91973: Improper Restriction of Excessive Authentication Attempts

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's...