PT-2026-67470

Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...

PT-2026-71355

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.5.33 etcd versions prior to 3.6.14 etcd versions prior to 3.7.1 Description In clusters with authentication enabled, a user with READ permission for a specific key can bypass authorization to receive watch events for a...

PT-2026-67613

Summary When a SASL PLAIN bind supplies an authorization identity authzid that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIED AUTH privilege and never evaluated the "proxy" access-control right the mayProxy ACI scope check. As a result, any account holding the...

PT-2026-67478

Am I affected? You are affected if your application registers the @better-auth/scim plugin and lets authenticated users generate SCIM tokens. The default canGenerateToken policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account...

PT-2026-71711

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.29.2 Description Experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for the...

PT-2026-67307

Name of the Vulnerable Software and Affected Versions better-auth versions 1.1.3 through 1.6.21 better-auth versions 1.7.0-beta.0 through 1.7.0-beta.9 Description A pre-account hijacking flaw allows account takeover when open email and password registration is enabled alongside magic-link or...

CVE-2026-15630 CVE-2026-15630

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

EUVD-2026-48377

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

CVE-2026-47669

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306836...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73421 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73421 Source advisory: OSV:GHSA-8FPG-XM3F-6CX3...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73421 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73421 Source advisory: GHSA-8FPG-XM3F-6CX3...

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...

NPM: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NPM: Auth.js: getToken throws an uncaught exception on malformed Bearer authorization headers vulnerability discovered by ? in WordPress Npm next-auth versions = 4.0.6, = 4.24.14...

Improper Check for Unusual or Exceptional Conditions

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sending...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306959...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by unknown CVE via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306959...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73418 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@12-apps/app-shell (>=1.0.0, <=5.13.1), @12-apps/auth (>=1.2.0, <=2.30.1) +268 more potentially affected by CVE-2026-73418 via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves: CVE-2026-73418 Source...