CVE-2026-118505: team-alembic ash_authentication: Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an…

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ashauthentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce bruteforcestrategy by adding a preparation only...

CVE-2023-52268

FreeScout End-User Portal Authentication Bypass Exploit CVE-2023-52268 Overview This exploit targets a vulnerability in the FreeScout End-User Portal Module versions below 1.0.65 that allows an attacker to bypass authentication through improper session token management. By generating and testing...

CVE-2026-39912

CVE-2026-39912 - Xboard / V2Board Unauth Account Takeover Magic Link Token Leak in loginWithMailLink | ---|--- CVE| CVE-2026-39912 CVSS| 9.1 Critical CWE| CWE-201 Insertion of Sensitive Information Into Sent Data Affected| V2Board = 1.6.1 through 1.7.4 / Xboard all versions through 0.1.9+ Fixed|...

io.phasetwo.keycloak:keycloak-events (>=0.18, <=0.19), io.phasetwo.keycloak:keycloak-magic-link (>=0.16, <=0.19) +18 more potentially affected by CVE-2026-9086 via org.keycloak:keycloak-services (22.0.0)

org.keycloak:keycloak-services MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.phasetwo.keycloak:keycloak-events =0.18, =0.16, =0.37, =0.9, =1.6, =2.1 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.3.0-20.0.1, <=0.3.3-20.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.2) +25 more potentially affected by CVE-2026-9086 via org.keycloak:keycloak-services (20.0.1)

org.keycloak:keycloak-services MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.3.0-20.0.1, =0.6, =0.2, =0.2, =0.3, =0.11 -...

io.phasetwo.keycloak:keycloak-events (>=0.18, <=0.19), io.phasetwo.keycloak:keycloak-magic-link (>=0.16, <=0.19) +18 more potentially affected by CVE-2026-9083 via org.keycloak:keycloak-services (22.0.0)

org.keycloak:keycloak-services MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.phasetwo.keycloak:keycloak-events =0.18, =0.16, =0.37, =0.9, =1.6, =2.1 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.3.0-20.0.1, <=0.3.3-20.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.2) +25 more potentially affected by CVE-2026-9083 via org.keycloak:keycloak-services (20.0.1)

org.keycloak:keycloak-services MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.3.0-20.0.1, =0.6, =0.2, =0.2, =0.3, =0.11 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.3.0-20.0.1, <=0.3.3-20.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.2) +25 more potentially affected by CVE-2026-9799 via org.keycloak:keycloak-services (20.0.1)

org.keycloak:keycloak-services MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.3.0-20.0.1, =0.6, =0.2, =0.2, =0.3, =0.11 -...

com.charlyghislain.keycloak:keycloak-importexport (23.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.13) +26 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-services (23.0.3)

org.keycloak:keycloak-services MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 23.0.1 -...

de.adorsys.sts:keycloak-storage-provider (>=1.1.23, <=1.1.28), io.phasetwo.keycloak:keycloak-events (0.20) +17 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-services (22.0.4)

org.keycloak:keycloak-services MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.1.23, =0.20, =0.12, =0.14 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.3.0-20.0.1, <=0.3.3-20.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.2) +25 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-services (20.0.1)

org.keycloak:keycloak-services MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.3.0-20.0.1, =0.6, =0.2, =0.2, =0.3, =0.11 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.3.0-20.0.1, <=0.3.3-20.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.2) +25 more potentially affected by CVE-2026-9705 via org.keycloak:keycloak-services (20.0.1)

org.keycloak:keycloak-services MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.3.0-20.0.1, =0.6, =0.2, =0.2, =0.3, =0.11 -...

Authentication Bypass

Better Auth is vulnerable to authentication bypass. The vulnerability is due to overlapping stored identifiers under specific Magic Link and OAuth configuration settings, which allows an unauthenticated attacker to exploit the OAuth sign-in flow to obtain a valid session for an existing user or...

Better-auth: OAuth State Can Be Used As A Magic Link To Sign In As Another User

Am I affected? You may be affected if you use "better-auth" from "1.4.0-beta.18" through versions before "1.7.7" with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default "storeToken: "plain"", or with...

npm: better-auth: OAuth state can be used as a Magic Link to sign in as another user

npm: better-auth: OAuth state can be used as a Magic Link to sign in as another user vulnerability discovered by ? in WordPress npm better-auth versions = 1.4.0-beta.18, 1.7.7...

GHSA-965C-763C-88JM better-auth: OAuth state can be used as a Magic Link to sign in as another user

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with storeToken:...

better-auth: OAuth state can be used as a Magic Link to sign in as another user

Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with storeToken:...

EUVD-2026-108256

better-auth: OAuth state can be used as a Magic Link to sign in as another user...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via insufficient isolation of verification records across different authentication flows. Because magic-link tokens and OAuth state...

CVE-2026-114607

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in...