CVE-2026-56850: Improper Authentication

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-58066: Improper Authentication

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...

CVE-2026-14300: Improper Authentication

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

ROS-20260729-73-0028

The vulnerability in coredns is related to the improper implementation of the authentication algorithm. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...

CVE-2026-13690: Improper Authentication

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user...

Exploit for Improper Authentication in Redhat Keycloak

PoC CVE-2023-0264 — front OIDC session hijacking Front está...

Improper Authentication

Overview pytonapi is a Python SDK for TONAPI — REST API, streaming, and webhooks for TON blockchain. Affected versions of this package are vulnerable to Improper Authentication in the TonapiWebhookDispatcher process when a webhook handler is registered with a custom path argument. An attacker can...

Exploit for Improper Authentication in Checkpoint Multi-Domain_Security_Management

No d...

CVE-2026-7187 Improper Authentication in Universal Sotware's UKBS

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-7187

The CVE-2026-7187 entry concerns Universal Software Inc. UKBS, affected through 2026-07-28 (through 28072026). Root cause: missing authentication for a critical function, allowing access to functionality not properly constrained by access control lists (ACLs). The issue targets the UKBS product a...

Improper Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Authentication through the Microsoft account token exchange flow in the Microsoft identity provider...

CVE-2026-49447: Improper Authentication

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

CVE-2026-54635: Improper Authentication

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

CVE-2026-65894 Improper Authentication Vulnerability in CP PLUS EZ-P21 IP Camera

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an...

EUVD-2026-49117

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an...

CVE-2026-65894

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an...

CVE-2026-65894

The CP PLUS EZ-P21 IP Camera is affected by an improper authentication of HTTP endpoints vulnerability. A remote attacker can perform brute‑force attempts against HTTP endpoints, potentially gaining unauthorized access to live video snapshots from the targeted device. CVSS 4.0 metrics indicate NE...

CVE-2026-12255: Improper Authentication

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account,...

Xerox Printers Improper Authentication (CVE-2023-46327)

Multiple MFPs multifunction printers provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encrypti...

CVE-2026-9830: Improper Authentication

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...