CVE-2026-120192

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /appdata of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

EUVD-2026-114751

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /appdata of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-120192 Presenton Desktop Authentication Middleware app_data information disclosure

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /appdata of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-120192 Presenton Desktop Authentication Middleware app_data information disclosure

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /appdata of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-120192 Presenton Desktop Authentication Middleware app_data information disclosure

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /appdata of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-120192

A security vulnerability exists in Presenton versions up to 0.9.11-beta , specifically affecting the Desktop Authentication Middleware component. The vulnerability is located within an unknown part of the /app_data file, where manipulation can lead to information disclosure . This issue can be tr...

PT-2026-134822

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-120192: n/a Presenton: A security vulnerability has been detected in Presenton up to 0.9.11-beta

A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /appdata of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been...

PT-2026-84019

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-82269

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269: Authentication Bypass Using an Alternate Path or Channel

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is setResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIVersion tested: 4.6.48.File:...

PT-2026-64118

praisonai: recipe serve authentication middleware silently disables itself when no secret is set Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai on PyPI Version tested: 4.6.48...

PT-2026-64119

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

GHSA-X9VC-9FFQ-P3GJ NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...

CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

CVE-2026-59801

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-56271 Flowise - Weak Default JWT Secrets in Authentication Middleware

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses weak hardcoded default JWT secrets 'authtoken', 'refreshtoken' and default audience and issuer values 'AUDIENCE', 'ISSUER' in the enterprise passport authentication middleware packages/server/src/enterprise/middleware/passport/index.t...

CVE-2026-56271

Flowise versions prior to 3.1.0 (specifically version 3.0.13 and earlier) are vulnerable to an authentication bypass due to weak hardcoded default JWT secrets in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). If the environment var...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the handling of HTTP headers in authentication middlewares. An attacker can impersonate users or escalate privileges by injecting underscore-variant headers that bypass canonical header strippin...