CVE-2026-86810

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory OIDC ID token decoders in the Spring Cloud Azure OAuth2 login components. An attacker can elevate privileges and sign in as an...

CVE-2026-78629

The Okta Hyperdrive agent plugin contains an improper authentication verification flaw in its MFA response handling. When an organization's policy does not require MFA for a given user, the plugin returns a success response that contains only a bare boolean validation indicator rather than a sign...

CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

CVE-2026-78629 Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

CVE-2026-78560

CVE-2026-78560 affects the Okta Access Gateway , specifically its optional pass-through authentication source , which accepts user identity from a client-supplied HTTP header without cryptographic validation. When this source is enabled without an upstream reverse proxy or firewall that sanitizes...

CVE-2026-78560 Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-78560 Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

EUVD-2026-74161

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810 Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-86810

Open-Web-Analytics (up to 1.9.1) contains an improper authentication vulnerability in the checkCapabilityAndAuthenticateUser function within Core/Controller.php (Controller component). A remote, unauthenticated attacker can manipulate this function to bypass authentication checks. The CVSS 3.1 sc...

Security Bulletin: Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

Summary Langflow provides a password reset capability through its user management API. The password reset endpoint accepts a current password field in the request body but does not verify it against the stored credential before applying the password change, and enforces no password complexity...

CVE-2026-86669

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...

CVE-2026-80097

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

CVE-2026-69854

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-73791

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69854

CVE-2026-69854 is an improper authentication vulnerability in Spring Cloud Azure that allows an unauthorized attacker to elevate privileges over a network . The CNA (Microsoft) assigned a CVSS 3.1 score of 9.0 (CRITICAL) with a changed scope , reflecting high impact on confidentiality, integrity,...

CVE-2026-86669

A remote improper authentication vulnerability in aircheng-org iWebShop-5 (versions up to 5.15 ) affects the Login function in controllers/systemseller.php. Manipulating the Name argument allows an unauthenticated remote attacker to bypass authentication. The project scores CVSS 3.1: 7.3 (HIGH) w...