CVE-2026-82586

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

CVE-2026-82754

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

EEF-CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Summary Improper Protection of Alternate Path vulnerability in ash-project ash\lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read...

EUVD-2026-72542

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

CVE-2026-82754

An Improper Protection of Alternate Path vulnerability in the ash_authentication_oauth2_server Elixir library (versions 0.1.0 through before 0.3.1) causes state-changing OAuth endpoints to be reachable under an unintended URL prefix. The oauth2_server_protocol_routes/1 function in the Phoenix rou...

EUVD-2026-72536

Improper Protection of Alternate Path vulnerability in ash-project ashauthenticationoauth2server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2serverprotocolroutes/1 in...

EEF-CVE-2026-82754 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

Summary Improper Protection of Alternate Path vulnerability in ash-project ash\authentication\oauth2\server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2\server\protocol\routes/1 in...

EUVD-2026-70798

Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62916

Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network...

PT-2026-85308

Name of the Vulnerable Software and Affected Versions Microsoft Entra ID affected versions not specified Description An authentication bypass exists that allows an unauthorized attacker to elevate privileges over a network by using an alternate path or channel. Recommendations At the moment, ther...

CVE-2026-81168

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-16647

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-16647 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

EUVD-2026-69995

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-16647

Drupal Disable Login Page (versions 0.0.0 through 1.1.4) contains an Authentication Bypass Using an Alternate Path or Channel flaw. The root cause is a cache invalidation failure : when the module enables login page access restrictions, it does not clear previously cached login page responses. An...

CVE-2026-81168

CVE-2026-81168 affects the Drupal CAPTCHA Protected Page module (versions 0.0.0 through 1.0.2). The module does not sufficiently validate its CAPTCHA verification cookies, allowing an unauthenticated user or automated bot to forge the cookie and bypass CAPTCHA verification entirely . This constit...

EUVD-2026-70006

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-76943 Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-76943

CVE-2026-76943 affects the Xiiaozet LK100W (LK100Wt) device, which contains an authentication weakness in an administrative service that allows an attacker to bypass access controls and obtain command execution capabilities. Successful exploitation could lead to unauthorized interaction with priv...

CVE-2026-16639

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...