CVE-2026-93650

CVE-2026-93650 affects Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14, specifically the get_client_ip function in saleor/account/throttling.py. The root cause is that client-supplied IP headers (X-Forwarded-For) are trusted, allowing IP spoofing to bypass rate limiting and enable excessive authent...

Obot: MCP Registry API readable without authentication

Summary In affected versions, enabling registry authentication OBOTSERVERENABLEREGISTRYAUTH=true does not actually protect the MCP Registry endpoints under /v0.1/ — they remain readable by unauthenticated callers. Am I affected? You are affected if you run Obot = v0.22.1 with...

GHSA-XCW4-53CC-HV32 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...

CVE-2026-61833

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-77386 Kyoo: OIDC login token can be redirected to an attacker-controlled URL

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and...

CVE-2026-77386 Kyoo: OIDC login token can be redirected to an attacker-controlled URL

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and...

CVE-2026-77386

Kyoo is a self-hosted media server for movies, series, and anime. Prior to version 5.1.0 , an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/...

EUVD-2026-83205

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and...

CVE-2026-77386 Kyoo: OIDC login token can be redirected to an attacker-controlled URL

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and...

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

grafana: Grafana: Session takeover via Auth Proxy cache key collision

On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...

Malicious code in test89-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b8794dc6672c38596cd891ce414dc2bce8c9db38cd8e08afc51b411415639e [email protected] runs node index.js from its preinstall lifecycle hook. On npm install, index.js collects host identity hostname, whoami, id, uname...

MAL-2026-16289 Malicious code in test890-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a873f4ca1e603a5d6dc6d888de73a7f2c766a66af13f56a49538034e1e8706fd On npm install, index.js runs as a preinstall script and collects installer-side identifiers - home directory path, hostname, username, configured DN...

MAL-2026-16288 Malicious code in test89-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b8794dc6672c38596cd891ce414dc2bce8c9db38cd8e08afc51b411415639e [email protected] runs node index.js from its preinstall lifecycle hook. On npm install, index.js collects host identity hostname, whoami, id, uname...

Malicious code in test890-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a873f4ca1e603a5d6dc6d888de73a7f2c766a66af13f56a49538034e1e8706fd On npm install, index.js runs as a preinstall script and collects installer-side identifiers - home directory path, hostname, username, configured DN...

Malicious code in test8999-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545 package.json declares a preinstall hook that runs index.js on npm install. index.js requires childprocess, os, http, and https, then collects host...

MAL-2026-16286 Malicious code in test8999-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545 package.json declares a preinstall hook that runs index.js on npm install. index.js requires childprocess, os, http, and https, then collects host...

Malicious code in test899-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...