8832 matches found
CVE-2026-53512: Improper Authentication
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refreshtoken grant authenticates only possession of the bound refreshToken row and matching clientid, without verifying the...
CVE-2026-53516: Improper Authentication
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts emailverified: true without requiring the local user row's emailVerified...
CVE-2026-53514: Improper Authentication
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation,...
CVE-2026-52893: Improper Authentication
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking emailverified. An attacker...
EUVD-2026-43944
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network...
EUVD-2026-44044
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
EUVD-2026-43757
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network...
EUVD-2026-44028
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-50365
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network...
CVE-2026-56169
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-56185
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network...
CVE-2026-50338
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-50338
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-56185
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network...
CVE-2026-56185
CVE-2026-56185 describes an information-disclosure issue in Windows Admin Center caused by improper authentication. The documented impact is that an authorized attacker can disclose information over a network, with a CVSS 3.1 base score of 6.5 (Network attack vector, Low attack complexity, Low pr...
CVE-2026-56169
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-56169
CVE-2026-56169 concerns improper authentication in Windows Admin Center that can allow an attacker authenticated on the network to elevate privileges. The CVSS 3.1 base score is 8.1 (High), with network as the attack vector, low attack complexity, and low privileges required; confidentiality and ...
CVE-2026-50338
Technical details are not publicly available in the provided documents. Monitor for updates from official sources.
