70 matches found
CVE-2026-20896
CVE-2026-20896 Gitea's official Docker image up to and including 1.26.2 ships REVERSEPROXYTRUSTEDPROXIES = in its default config. If you turn on reverse-proxy login, that wildcard means every source IP is treated as a trusted proxy, so anyone who can reach the port can send an X-WEBAUTH-USER head...
CVE-2026-20896
CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC !WARNING Use this PoC only in a local lab or against a system you are explicitly authorized to test. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Overview CVE-2026-20896 is an authentication bypass in...
CVE-2026-93483
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
CVE-2026-93483
In Znuny versions through 7.3.6 , a vulnerability exists where an attacker can bypass standard login procedures to gain unauthorized access to sensitive system functions. The root cause is the application's incorrect trust in the Remote-User HTTP request header. Specifically, the Kernel::System::...
CVE-2026-93483
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
UBUNTU-CVE-2026-93483
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
Linux Distros Unpatched Vulnerability : CVE-2026-93483
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a...
PT-2026-114756
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
CVE-2026-93483: Use of Less Trusted Source
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
Linux Distros Unpatched Vulnerability : CVE-2026-93582
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER...
CVE-2026-93582
The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...
UBUNTU-CVE-2026-93582
The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...
CVE-2026-93582 Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...
PT-2026-110493
Name of the Vulnerable Software and Affected Versions OTRS Community Edition versions 6.x and earlier Description The HTTP Basic Authentication modules trust the authenticated username provided via the REMOTE USER or HTTP REMOTE USER environment variables. In CGI and mod perl based deployments,...
CVE-2026-93582: Authentication Bypass by Spoofing
The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...
CVE-2026-80199 Kimai before 2.54.0 Username Enumeration via Timing Oracle
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...
CVE-2026-18972
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...
CVE-2026-20896 — Updated!
CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC !WARNING Use this PoC only in a local lab or against a system you are explicitly authorized to test. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Overview CVE-2026-20896 is an authentication bypass in...
CVE-2026-49332
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...
PT-2026-65683
Name of the Vulnerable Software and Affected Versions Cosmos-Server affected versions not specified Description An authentication bypass exists in the tokenMiddleware function within src/proxy/routerGen.go. The issue occurs when the Constellation-tunnel bypass branch is triggered, causing the...