CVE-2026-65583 Apache CXF: Self-issued ID token claims validation skipped

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks issuer/subject/audience/time and subjwk binding, enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in...

CVE-2025-15039

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

CVE-2026-5430 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...

CVE-2025-15039

CVE-2025-15039 concerns the Conditional Authentication (Adaptive Authentication) script in multiple WSO2 products. The flaw is that the script does not properly enforce completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configure...

EUVD-2025-210632

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

CVE-2024-6832 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

WordPress WPMU DEV Dashboard plugin <= 5.0.0 - Authentication Bypass to Arbitrary plugin Installation (Remote Code Execution) vulnerability

Authentication Bypass to Arbitrary plugin Installation Remote Code Execution vulnerability discovered by Austin Ginder in WordPress Plugin WPMU DEV Dashboard versions = 5.0.0...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15459 WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

EUVD-2026-53710

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15991 File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

EUVD-2026-53700

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The...

PT-2026-68772

Name of the Vulnerable Software and Affected Versions macOS Tahoe versions prior to 26.6.1 macOS Sequoia versions prior to 15.7.9 macOS Sonoma versions prior to 14.8.9 Description An authentication bypass exists in the built-in Screen Sharing feature, which allows remote desktop management via th...

N-able N-central authorization issue vulnerability

N-able N-central is a remote monitoring and management system developed by the Canadian company N-able. Versions of N-able N-central prior to 2026.1 contained security vulnerabilities. Attackers could exploit these vulnerabilities to bypass authentication processes...

CVE-2025-63823

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

CVE-2026-71319 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the route rule matching. An attacker can gain unauthorized access to protected pages and sensitive data by crafting requests to mixed-case paths that bypass authentication middleware. Workaround This...

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates incomplete fix for CVE-2026-53721 vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...