EUVD-2026-113523

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0...

CVE-2026-118582

The Drupal CAPTCHA module is vulnerable to a functionality bypass due to incomplete invalidation of solved CAPTCHA sessions. While the module remembers solved challenges to allow multi-step forms to proceed, it fails to fully invalidate these sessions, allowing a protected form to be resubmitted ...

EUVD-2026-113695

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11...

CVE-2026-118572 OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1...

EUVD-2026-113690

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1...

CVE-2026-118572

The Drupal OAuth Login - OAuth OIDC SSO module versions 0.0.0 through 3.1.1 is vulnerable to an authentication bypass (CWE-288). The root cause is the module's failure to sufficiently check access on a configuration route and its failure to verify if the returned email address was actually verifi...

CVE-2026-118554

The Drupal OpenID Connect Client module (versions 0.0.0 to 2.3.1 ) contains an authentication bypass vulnerability. The root cause is that the module attempts to link a new user logging in via OpenID Connect (oAuth2) to an existing account sharing the same email address. This allows an attacker t...

CVE-2026-118554 OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

EUVD-2026-113687

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2026-110985

A flaw was found in Apache Kafka. When configured to use token-based authentication without a remote key validation endpoint, the broker falls back to an internal validator that does not check JSON Web Token JWT signatures, algorithms, or issuers. An unauthenticated remote attacker can exploit th...

Western Digital MyCloud NAS - Authentication Bypass

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

CyberPanel v2.3.6 Pre-Auth Remote Code Execution

upgrademysqlstatus in databases/views.py in CyberPanel aka Cyber Panel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware which is only for a POST request and using shell metacharacters in the...

AhsayCBS - JSON API Authentication Bypass

Ahsay AhsayCBS = 10.3.2 contains an authentication bypass caused by manipulation of the "random" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation. id: CVE-2026-105133 info: name: AhsayCBS - JSON API...

Burp-SessionAuthTool

ARCHIVED This project isn't maintained anymore by me. Feel free to fork! See this blog article for a full description of what this is...

CVE-2025-49602: n/a: An issue was discovered in Keyfactor EJBCA 9

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time default: 30 seconds, which results in the former...

PT-2026-133506

Name of the Vulnerable Software and Affected Versions vsftpd versions prior to 3.0.6 Description An authentication bypass exists in the ssl data accept function. Unauthenticated attackers who share the same source IP address as a victim can hijack FTPS data connections by resuming their own TLS...

PT-2026-133541

Name of the Vulnerable Software and Affected Versions Traefik versions 3.7.0-ea.1 through 3.7.14 Description An authentication bypass exists in the Kubernetes Ingress NGINX provider. The issue occurs when mTLS mutual TLS, a process where both client and server authenticate each other configured v...

CVE-2026-119426: phpMyAdmin: phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute…

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

CVE-2026-119429: phpMyAdmin: phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to…

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...