531 matches found
CVE-2026-17681
The CVE-2026-17681 entry is validated by the connected Chrome release data: Google Chrome on Android versions affected prior to 151.0.7922.72 had insufficient validation of untrusted input in Web Authentication, enabling a renderer-compromise–driven sandbox escape via a crafted HTML page. The vul...
PT-2026-66000
Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method
Reauthentication Bypass via One-Time Access Token Login Summary A weaker authentication method OTA token or signup token is accepted as passkey step-up proof, yielding unauthorized renewable 30-day OIDC refresh tokens for clients explicitly configured with RequiresReauthentication: true. The POST...
CVE-2026-13862
An insufficient policy enforcement flaw was found in the Web Authentication Passkeys & Security Keys component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=495897416...
CVE-2026-14074
A side-channel information leakage flaw was found in the WebAuthentication component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511743480...
CVE-2026-65894
This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device. Successful exploitation of this vulnerability could allow an...
GHSA-GF8H-GQ53-288J OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...
Astra Linux – Vulnerability in Chromium
The use of after free in Web Authentication in Google Chrome before version 149.0.7827.155 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
The use of after free in WebAuthentication in Google Chrome before version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of “after free” in Web Authentication in Google Chrome before version 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted Chrome Extension. Chromium security severity: High...
GO-2026-6051 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea
Gitea Docker image: REVERSEPROXYTRUSTEDPROXIES = default lets any source IP impersonate any user via X-WEBAUTH-USER in code.gitea.io/gitea...
EUVD-2026-47770
ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication MFA configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA...
EUVD-2026-41613
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface...
GHSA-F75J-4CW6-RMX4 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
Summary The Gitea Docker images ship an app.ini template that hard-codes: REVERSEPROXYTRUSTEDPROXIES = The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted. When an admin enables ENABLEREVERSEPROXYAUTHENTICATION = true to p...
PT-2026-63309
This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c...
CVE-2026-15429
CVE-2026-15429 affects the Archer VX1800v v1 HTTP authentication component. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data. An authenticated user with sufficient privileges can modify account settings and achie...
CVE-2026-15429 Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v
A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data. An authenticated user with sufficient privileges may be abl...
CVE-2026-10714
The CVE-2026-10714 issue affects FactoryTalk Services Platform (FTSP) . It hinges on a JWT validation bypass where the application does not verify that the JWT algorithm is configured for RSA, allowing an attacker to set the algorithm to "none" and forge tokens. This could enable an authenticated...
CVE-2026-55377 Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new...