CVE-2026-73421: Improper Authorization

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-49857: Server-Side Request Forgery (SSRF)

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

PT-2026-71663

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x Description An authorization bypass exists in the parsing of the auth users directive. The parser utilizes comma-only tokenization when splitting the user list, which fails to correctly process entries...

CVE-2026-70463: Incorrect Authorization

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the...

PT-2026-71439

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

PT-2026-71871

Name of the Vulnerable Software and Affected Versions Vault Secrets Operator versions 1.3.0 through 1.4.1 Description An arbitrary file read and credential exfiltration issue exists in the AppRole authentication configuration. This allows a tenant with limited Kubernetes RBAC Role-Based Access...

PT-2026-71880

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

SUSE SLED15: openvpn / openvpn-auth-pam-plugin / openvpn-dco / openvpn-dco-devel / etc (SUSE-SU-2026:3596-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3596-1 advisory. - CVE-2026-11771: NTLM proxy auth stack off-by-one write bsc1273126. - CVE-2026-12932: memory leak using...

CVE-2026-73499

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

CVE-2026-73501

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73430

Russh (Rust SSH client/server library) before version 0.62.4 is affected. An unauthenticated SSH client can trigger a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. In Curve25519Kex::server_dh, the all-zero peer public value is accepted, leading to a zero sh...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an...

CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

CVE-2026-73429

CVE-2026-73429 affects Russh (Rust SSH client/server library) prior to v0.62.4. A malicious SSH server can trigger a deterministic panic in the client during KEX_ECDH_REPLY handling when the server_ephemeral value is not 32 bytes, as Curve25519Kex::compute_shared_secret passes the decoded value t...

CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in...

@app-box/web (1.0.0), @chirpy-dev/analytics (0.0.1) +87 more potentially affected by CVE-2026-73419 via next-auth (>=0.0.0-manual.83c4ebd1, <=4.24.13)

next-auth NPM version =0.0.0-manual.83c4ebd1, =0.1.0, =1.9.0, =3.0.0-canary.160.0, =2.0.1-canary.24.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.1 - @lowdefy/community-plugin-auth 1.0.4 and more Source cves: CVE-2026-73419 Source advisory: MEND:CVE-2026-73419...