CVE-2026-62302

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in...

EUVD-2026-114369

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, server.ts calls registerStaticRoutes and registerCloudRoutes before registerApiRoutes, where authMiddleware and roleBasedAuthMiddleware are mounted. Because Express processes middleware in...

ChurchCRM API Authentication Bypass (CVE-2026-39339)

Exploits CVE-2026-39339 in ChurchCRM 7.1.0: URL injection with ?bypass=/api/public on protected API routes bypasses AuthMiddleware and returns sensitive person/family records without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM API auth bypass via URL injection...

Malicious code in @0l00000l/auth (npm)

Source: amazon-inspector cb367562977f8319b3d37aab67a64f2298ae3a9b41d5980a7c66d22c3d135923 The package presents itself as a generic authentication library and exposes register/login/logout/verifyEmail/forgotPassword/resetPassword/verifyToken handlers plus an Express authMiddleware. Each handler...

CVE-2025-11529

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

CVE-2025-11529

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

EUVD-2025-33260

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

CVE-2025-11529 ChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authentication

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

CVE-2025-11529

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

CVE-2025-11529

This CVE affects ChurchCRM up to version 5.18.0 in the API Endpoint’s AuthMiddleware (src/ChurchCRM/Slim/Middleware/AuthMiddleware.php). The vulnerability is an authentication bypass: the AuthMiddleware function allows missing authentication, enabling remote exploitation. Public exploits exist, a...

CVE-2025-11529: Missing Authentication for Critical Function

A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack can be executed remotely. The exploit...

ChurchCRM security vulnerabilities

ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM 5.18.0 and earlier versions have an authentication error vulnerability that stems from a lack of authentication in the AuthMiddleware function in the API Endpoint component, which can be exploited by an attacker ...