CVE-2026-6355

Augmentt: Acesso entre Tenants via IDOR Créditos Este CVE foi um esforço colaborativo entre: Raznov – GitHub: https://github.com/basraznov HelloWorld Autor– GitHub: https://github.com/Penquinsecq Descrição Uma vulnerabilidade na aplicação web permite que usuários não autorizados acessem e manipul...

CVE-2026-23552

CVE-2026-23552 - Aceitação de Token Entre Reinos no camel-keycloak Visão Geral O KeycloakSecurityPolicy do Apache Camel não valida a declaração iss emissor dos tokens JWT em relação ao realm configurado. Isso significa que um token emitido por um realm do Keycloak é silenciosamente aceito por uma...

CVE-2026-55176

In Soft Machine versions 0.2.247 and prior , an authentication bypass exists in the /app/server.js file. The helper functions verifyContainerAuth() and authenticateWorkspaceHttp() incorrectly accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying workspace ownership. Since ...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

EUVD-2026-89539

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055 AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-103055

AiSOC versions 7.5.0 before 12.0.0 are vulnerable to an authentication bypass due to the use of a hard-coded constant for JWT verification in the realtime WebSocket and SSE service . This flaw occurs specifically when the AISOC_REALTIME_JWT_SECRET environment variable is not configured. Unauthent...

CVE-2026-103055: Use of Hard-coded Cryptographic Key

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

CVE-2026-102876

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

EUVD-2026-89411

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876

SurrealDB versions prior to 3.3.0 are vulnerable to an authorization bypass during HTTP session construction. The root cause lies in the check_auth() function, which verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but erroneously constructs sessions using Surreal-NS and S...

CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-102876: Authorization Bypass Through User-Controlled Key

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

PT-2026-102892

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check auth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87703

Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode MODE=queue, ENABLEBULLMQDASHBOARD=true, and !isCloud, the /admin/queues mount is protected only by the...

PT-2026-99279

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description When the server operates in queue mode with the dashboard enabled and is not in cloud mode MODE=queue, ENABLE BULLMQ DASHBOARD=true, and !isCloud, the /admin/queues endpoint is protected only by the...