1027 matches found
SUSE CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
Weak Authentication
Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Weak Authentication via the JWT authentication flow's email-based fallback lookup, which does not verify the emailverified claim before resolving a user identity. An attack...
CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
CVE-2026-93355
The LiteLLM platform is vulnerable to a weak JWT authentication flaw caused by an email-based fallback lookup that fails to verify the email_verified claim. An attacker with a valid JWT from a configured identity provider can authenticate as any existing user by using an unverified email address ...
EUVD-2026-88462
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
CVE-2026-93355: Weak Authentication
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the emailverified claim...
PT-2026-102338
Name of the Vulnerable Software and Affected Versions LiteLLM affected versions not specified Description A weak authentication issue exists in the JWT authentication flow. An attacker with a valid JSON Web Token JWT from the configured identity provider can authenticate as any existing user by...
CVE-2026-92288: Weak Authentication
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndPointAuthenticationCredentials skips th...
BIT-DOTNET-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...
BIT-DOTNET-SDK-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...
BIT-ASPNET-CORE-2025-7326 EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life EOL software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry...
sj v2.8.2
sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...
CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...
CVE-2026-77483
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-73025
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network...
EUVD-2026-73784
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-77483
CVE-2026-77483 affects Microsoft SQL Server and involves a weak authentication mechanism that allows an authorized attacker (low privileges required) to elevate privileges over a network . The CVSS 3.1 score is 8.8 (HIGH) with vectors for network attack, low complexity, no user interaction, and h...
EUVD-2026-73778
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-73025
CVE-2026-73025 is a Security Feature Bypass vulnerability in Windows iSCSI , rooted in weak authentication that allows an unauthorized attacker to bypass a security feature over a network. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector, low complexity, n...
