CVE-2023-7028

CVE-2023-7028 Обнаружена проблема в GitLab CE/EE, затрагивающая все версии от 16.1 до 16.1.6, от 16.2 до 16.2.9, от 16.3 до 16.3.7, от 16.4 до 16.4.5, от 16.5 до 16.5.6, от 16.6 до 16.6.4 и от 16.7 до 16.7.2, в которых письма для сброса пароля учётной записи могли доставляться на неподтверждённый...

CVE-2026-81294

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-81294 CVE-2026-81294 — WordPress WordPress — Authorizer 3.15.1 — Paul Ryan Unauthenticated Privilege Escalation in Authorizer = 3.15.1 versions. | ---|--- CVE| CVE-2026-81294 · CVE.org CWE| CWE-266 CVSS| Critical: 9.8...

CVE-2026-63472

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

CVE-2026-63472

Vendure , an open-source headless commerce platform, is vulnerable to account takeover via its external authentication system. In ExternalAuthenticationService.createCustomerAndUser, an existing customer is matched by email address alone and a new external authentication method is attached withou...

CVE-2026-63472 Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

ZITADEL: Auto-linking by email: IdP-side email verification is not checked

Summary A flaw in the external identity provider handler allows unauthorized account linking to occur under specific administrative configurations. When auto-linking by email is enabled, ZITADEL checks that the local user's email is verified, but does not explicitly cross-check whether the incomi...

CVE-2026-61641

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...

CVE-2026-61641

Wallos (open-source personal subscription tracker) versions 4.0.0 through before 4.9.6 contain an OIDC login flaw where an incoming identity is linked to an existing local account by matching the email claim alone, without verifying the IdP's email_verified attribute. When the configured IdP allo...

CVE-2026-77508 Weblate: Unverified REST API email changes

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/username/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the...

CVE-2026-77508

Weblate , a web-based localization tool, is affected by an unverified email-change vulnerability prior to version 2026.8 . An authenticated user can modify their primary email via PUT or PATCH requests to /api/users/{username}/ without the new address being verified. This allows a subsequent team...

CVE-2026-77508 Weblate: Unverified REST API email changes

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/username/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the...

CVE-2026-76793 Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators...

CVE-2026-76793

The Firebase Authentication WordPress plugin before 1.7.1 fails to verify the email address in a Firebase authentication token before matching it to a WordPress account and issuing a session. This allows unauthenticated attackers to log in as any user, including administrators, by crafting a toke...

ANT-2026-7WJV60DR · supabase/auth · other

other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-7WJV60DR: Manual identity linking enables account takeover via unverified email When...

GHSA-29RF-F4VV-PVQ6 Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

The OAuth callback handler links incoming OAuth identities Google, GitHub, etc. to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address without verifying it...

CVE-2026-73655

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser in apps/webapp/app/models/user.server.ts without requiring Google'...

CVE-2026-18961

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...

CVE-2026-18961

The CVE describes a vulnerability in the VentraConnect Social Login WordPress plugin (up to version 1.4.3) where an unverified email field returned by Spotify’s /v1/me endpoint is trusted as mailbox ownership. The plugin copies this value into a user profile and logs in the user via get_user_by('...

CVE-2026-18961 Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to, and including, 1.4.3. This is due to the plugin trusting the unverified email field returned by...