CVE-2026-63244

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System LMS could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised...

EUVD-2026-108611

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System LMS could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised...

CVE-2026-63244

An authentication bypass vulnerability exists in WizLearn Technologies' Learning Management System (LMS) . An unauthenticated remote attacker can bypass both password authentication and the OAuth authentication flow by sending a specially crafted POST request . Successful exploitation could lead ...

CVE-2026-110744

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

EUVD-2026-107418

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

CVE-2026-110744 Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

CVE-2026-110744

A vulnerability exists in multicluster-global-hub-operator-bundle due to overly broad role-based access control (RBAC) permissions. This flaw allows for unrestricted, cluster-wide impersonation of arbitrary users, groups, and service accounts. An attacker who successfully compromises the operator...

CVE-2026-110744

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator...

CVE-2026-111690

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

CVE-2026-111641

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...

CVE-2026-111690

Simple Admin Core versions through 1.8.7 are vulnerable to an authentication bypass due to a hard-coded Auth.AccessSecret in api/etc/core.yaml. Unauthenticated attackers can leverage this public secret to forge a JWT with a roleId claim of 001, granting them full administrative control over users...

CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

EUVD-2026-102981

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

EUVD-2026-103063

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...

CVE-2026-111641

FastapiAdmin versions through 3.0 are vulnerable to an authentication bypass due to unprotected auto-login endpoints. An unauthenticated attacker can exploit this by listing users via /api/v1/auth/auto-login/users, minting a superuser auto-login token , and exchanging it for a JWT session . This ...

CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...

CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints

FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange i...

CVE-2026-111690: Use of Hard-coded Cryptographic Key

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain fu...

PT-2026-116040

Name of the Vulnerable Software and Affected Versions FastapiAdmin versions prior to 3.1 Description An authentication bypass allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via the...