Linux Distros Unpatched Vulnerability : CVE-2026-64320

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmetexecutediscgetlogpage validates only the dword alignment of the host-supplied Log Pa...

MAL-2026-11069 Malicious code in clerk-next-fix-auth-protection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd8aaf2fc6ca964eed6950b6868486125905bacabe6b8bb1cbd581bb6a59f4c [email protected] is a typosquat of Clerk/Next.js auth tooling that ships no functional code declared main index.js is absent from...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SASL PLAIN authentication process. An attacker can gain unauthorized access to arbitrary directory user accounts by supplying an authorization identity authzid that resolves to a...

GHSA-P279-2CQP-84JG OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIEDAUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

GO-2026-5346 Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy

Caddy: FastCGI header normalization bypass in forwardauth copyheaders in github.com/caddyserver/caddy...

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

GHSA-G9HV-X236-4QP3 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Summary A malicious SSH server can crash a russh client session with a single malformed key-exchange reply, causing a pre-authentication Denial-of-Service before the server host key is verified. The embedding process itself stays up, but the connection is killed deterministically. Details Every...

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

A pre-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An unauthenticated client sends a single SSHMSGKEXECDHINIT whose QC is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero pee...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

Open Redirect

Overview @backstage/plugin-auth-backend is an A Backstage backend plugin that handles authentication Affected versions of this package are vulnerable to Open Redirect via the allowlist matching process. An attacker can intercept authorization codes by registering an OAuth client with a crafted...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.18-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.2-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.17-next.0) +12 more potentially affected by CVE-2026-73563 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.1-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.18-next.0) +12 more potentially affected by unknown CVE via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.29.2-next.0)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748,...

Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

Am I affected You are affected if all of the following hold: - You run a better-auth version below 1.6.22, or a 1.7.0-beta below 1.7.0-beta.10. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist a...

@enbi/auth (>=0.1.0, <=0.11.0), @enbi/cli (>=0.1.0, <=0.11.0) +2 more potentially affected by unknown CVE via better-auth (>=1.7.0-beta.0, <=1.7.0-beta.9)

better-auth NPM version =1.7.0-beta.0, =0.1.0, =0.1.0, =0.1.0, =1.7.0-beta.0, =1.7.0-beta.9 Source cves: unknown CVE Source advisory: GHSA-QQ9H-G4JM-XGF3...

GHSA-QQ9H-G4JM-XGF3 Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

Am I affected You are affected if all of the following hold: - You run a better-auth version below 1.6.22, or a 1.7.0-beta below 1.7.0-beta.10. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist a...

@enbi/auth (>=0.1.0, <=0.11.0), @enbi/cli (>=0.1.0, <=0.11.0) +2 more potentially affected by CVE-2026-67327 via better-auth (>=1.7.0-beta.0, <=1.7.0-beta.9)

better-auth NPM version =1.7.0-beta.0, =0.1.0, =0.1.0, =0.1.0, =1.7.0-beta.0, =1.7.0-beta.9 Source cves: CVE-2026-67327 Source advisory: SNYK:JS-BETTERAUTH-18319507...

@enbi/auth (>=0.1.0, <=0.11.0), @enbi/cli (>=0.1.0, <=0.11.0) +2 more potentially affected by CVE-2026-67327 via better-auth (>=1.7.0-beta.0, <=1.7.0-beta.9)

better-auth NPM version =1.7.0-beta.0, =0.1.0, =0.1.0, =0.1.0, =1.7.0-beta.0, =1.7.0-beta.9 Source cves: CVE-2026-67327 Source advisory: OSV:GHSA-QQ9H-G4JM-XGF3...

Insufficient Verification of Data Authenticity

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the authentication process. An attacker can gain persistent unauthorized access to user accounts by...

Incorrect Authorization

Overview @better-auth/stripe is a Stripe plugin for Better Auth Affected versions of this package are vulnerable to Incorrect Authorization through the handling of organization subscription actions when the authorizeReference callback is used and both subscription.enabled and organization.enabled...