CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

Zyxel NAS - Auth Bypass Indicator (CVE-2023-27992 family)

Detects Zyxel NAS authentication bypass via /cmd,/ck6fup6/zylogmain/configuremailsyslog, indicating exposure to the Jun/Nov 2023 vulnerability set including pre-auth command injection CVE-2023-27992 and related issues. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS authentication bypass...

SoftPerfect Bandwidth Manager - Auth Bypass Detection

Detects SoftPerfect Bandwidth Manager auth bypass via Basic AAAA and XML getoptions returning . !/usr/bin/env python3 -- coding: utf-8 -- """SoftPerfect Bandwidth Manager Basic Auth bypass / password disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import...

GlassFish - Admin Console TRACE Bypass Detection (CVE-2011-1511)

Detects CVE-2011-1511 by issuing TRACE to manageUserNew.jsf and matching ConfirmPassword / NewPassword form fields. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle GlassFish Admin Console TRACE auth bypass CVE-2011-1511.""" from kittysploit import from lib.protocols.http.httpclient import...

FreePBX ARI - Cookie Auth Bypass Detection (CVE-2014-7235)

Detects CVE-2014-7235 by sending crafted ariauth cookie to /recordings/index.php and matching authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX ARI recordings auth bypass CVE-2014-7235.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ColdFusion - RDS Auth Bypass Detection (CVE-2013-0632)

Detects CVE-2013-0632 by POSTing adminpassword=&rdsPasswordAllowed=1 to administrator.cfc?method=login and accessing the admin homepage. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...

RomPager - Misfortune Cookie Detection (CVE-2014-9222)

Detects CVE-2014-9222 by sending Cookie C107373883=/ to /tr069 and matching the token plus RomPager not-found marker. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie CVE-2014-9222.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Synology DSM Drive Server - Auth Bypass Token Leak (CVE-2024-50630)

Synology Drive Server on DSM allows unauthenticated attackers to read Drive logs via RedirectURI and obtain user access tokens via SYNO.SynologyDrive.Authentication CVE-2024-50630 / SA-24:21. Also indicates CVE-2024-50631 SQLi in sync daemon. !/usr/bin/env python3 -- coding: utf-8 -- """Synology...

PHP File Manager - Backdoor Login Detection

Detects PHP File Manager backdoor account DONOTREMOVETHISENTRY / travan44 via multipart login. !/usr/bin/env python3 -- coding: utf-8 -- """PHP File Manager hardcoded backdoor credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

up.time - firstTimeLogin Authentication Bypass Detection

Detects up.time = 5.0 auth bypass surface via index.php?userid=admin&firstTimeLogin=True matching blank-password validation response. !/usr/bin/env python3 -- coding: utf-8 -- """Detects up.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Home Assistant - Supervisor Auth Bypass Detection (CVE-2023-27482)

Home Assistant supervised installs are vulnerable to authentication bypass via path traversal under /api/hassio/app/ and /api/hassioingress/ CVE-2023-27482, exposing supervisor/core info without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor authentication...

Synology Drive Server - Unauth Access Token Leak (CVE-2024-50630)

Reads Synology Drive logs via CVE-2024-50629 RedirectURI abuse, extracts usernames, then calls SYNO.SynologyDrive.Authentication to obtain access tokens without credentials CVE-2024-50630 / SA-24:21. !/usr/bin/env python3 -- coding: utf-8 -- """Synology Drive Server unauthenticated access-token...

PT-2026-69951

Name of the Vulnerable Software and Affected Versions MaaS API affected versions not specified Description A flaw in the MaaS API allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway. This occurs because the system trusts the X-MaaS-Username and X-MaaS-Group HTTP headers...

PT-2026-69472

Name of the Vulnerable Software and Affected Versions bluewave-labs/Checkmate versions prior to 2.1.1 Description An unauthenticated remote attacker can determine if a specific email address is registered in the system. This is possible because the 'POST /api/v1/auth/recovery/request' endpoint...

PT-2026-69530

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ntlm authenticate function, the destroy previous session function is called using a user pointer derived from the client-supplied NTLM blob username field before the NTLMv2 respon...

CVE-2026-19278: Permissive Regular Expression

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...

Linux Ceph Auth Buffer Overflow

The vulnerability of the cephhandleauthreply function in the net/ceph/auth.c module of the Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality and accessibility of...

CVE-2026-72582: NULL Pointer Dereference

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating i...

CVE-2026-72588: Observable Response Discrepancy

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...

PT-2026-69556

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where ceph x create authorizer caches the iov base and iov len of the authorizer buffer within the ceph auth handshake structure. When ceph x update authorizer...