46 matches found
CVE-2026-41916
OpenClaw vulnerability CVE-2026-41916 affects the OpenClaw npm package prior to 2026.4.8. The issue is an authentication state management flaw where the resolvedAuth closure becomes stale after a configuration reload, causing newly accepted gateway connections to continue using an outdated authen...
EUVD-2026-26122
OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through...
CVE-2026-41916 OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload
OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through...
CVE-2026-41916 OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload
OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through...
OpenClaw 代码问题漏洞
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.8 had code vulnerabilities related to authentication state management. These vulnerabilities were resolved after configuration reloading, but the resolvedAuth closure became...
curl: CVE-2026-7168: cross-proxy Digest auth state leak
Summary: On libcurl 8.19.0, Proxy Digest state learned from proxyA survives an independent transfer boundary on a reused easy handle and is emitted preemptively to proxyB when the proxy is changed. In the attached C PoC, the first CONNECT to proxyB carries Proxy-Authorization: Digest ... built fr...
Insufficient Session Expiration
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration due to the resolvedAuth process becoming outdated after a configuration reload. An attacker can maintain unauthorized access by leveraging stale...
Exploit for CVE-2026-7731
CTT-Refraction-Vortex-CVE-2026-7731- Under CTT, we see it as a...
EUVD-2025-206327
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation...
CVE-2025-14751
A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escalation...
curl: libcurl: Improper Authentication State Management on Cross-Protocol Redirects
Following the recent advisory for CVE-2025-14524, I conducted an investigation into how libcurl manages OAuth2 credentials during complex redirect chains. I have confirmed that while the library successfully protects traditional user credentials, it fails to clear OAuth2 Bearer tokens in the same...
curl: State Isolation Failure in Multiplexed Connections (Shared Auth Context)
Vulnerability: State Isolation Failure in Multiplexed Connections Shared Auth Context Product: libcurl Affected Versions: v7.43.0 - Current v8.x - All versions supporting HTTP/2 Multiplexing Severity: CRITICAL CVSS: 9.1 1. Executive Summary A fundamental design flaw exists in libcurl's state...
Kentico Xperience Security Bypass Vulnerability
Kentico Xperience is a digital experience platform from Kentico. A security bypass vulnerability exists in Kentico Xperience, which can be exploited by an attacker to cause a compromise of session security and authentication state...
CVE-2024-58317
A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session...
CVE-2024-58317 Kentico Xperience <= 13.0.164 Cookie Security Configuration
A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session...
CVE-2025-11986
CVE-2025-11986 affects the WordPress Crypto Tool plugin (
CVE-2025-11986 Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State
The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action wpajaxnoprivcryptoconnectajaxprocess that allows calling the register and savenft methods with only a...
CVE-2025-11986 Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State
The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action wpajaxnoprivcryptoconnectajaxprocess that allows calling the register and savenft methods with only a...
WordPress Crypto Tool plugin <= 2.22 - Unauthenticated Information Exposure via Global Authentication State vulnerability
Unauthenticated Information Exposure via Global Authentication State vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Crypto versions = 2.22...