CVE-2026-41615

CVE-2026-41615 affects Microsoft Authenticator. The available documents identify an information disclosure vulnerability that could allow an unauthorized network actor to exfiltrate sensitive data from the Microsoft Authenticator component. The CVSS 3.1 score is 9.6 (CRITICAL) with Network attack...

CVE-2026-41615 Microsoft Authenticator Information Disclosure Vulnerability

...

CVE-2026-41615

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network...

CVE-2026-41615 Microsoft Authenticator Information Disclosure Vulnerability

...

EUVD-2026-30342

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network...

Microsoft Authenticator Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network...

KLA91047 OSI vulnerability in Microsoft Apps

An information disclosure vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2026-41615 Exploitation Related products Microsoft-Authenticator-for-Android Microsoft-Authenticator-for-IOS CVE list...

Microsoft Authenticator information leakage vulnerability

Microsoft Authenticator is an application for multi-factor authentication developed by Microsoft Corporation in the United States. There is an information leakage vulnerability in Microsoft Authenticator. This vulnerability stems from the exposure of sensitive information to unauthorized...

CVE-2026-41615: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network...

PT-2026-40974

Name of the Vulnerable Software and Affected Versions Microsoft Authenticator affected versions not specified Description Exposure of sensitive information in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no...

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

bomiot (>=0.2.86, <=0.8.5), cashd (>=0.2.0, <=0.3.4.post1) +9 more potentially affected by CVE-2026-42304 via twisted (24.7.0)

twisted PYPI version 24.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - bomiot =0.2.86, =0.2.0, =0.7.1, =0.3.1, =0.8.1, =4.0.0, =4.0.0, =0.1.0, =0.6.2, =0.1.0, =0.0.1, =0.1.5 Source cves: CVE-2026-42304 Source advisor...

CVE-2026-42602

The CVE affects opentelemetry-collector-contrib’s azureauthextension in versions 0.124.0–0.150.0. The root cause is that Authenticate performs a token equality check against a token minted by the collector’s own credential, using the client-supplied Host header to set the scope, and does not vali...

CVE-2026-42602 azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

CVE-2026-42602 azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

CVE-2026-44277

Affected vendor/product : Fortinet FortiAuthenticator. Versions affected : 8.0.2, 8.0.0, 6.6.0–6.6.8, 6.5.0–6.5.6. Vulnerability type : improper access control. Impact : may allow an attacker to execute unauthorized code or commands via an attack vector (not specified in the provided documents). ...

CVE-2026-44277

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests...

CVE-2026-44277

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests...

CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported...

WSO2’s various products have security vulnerabilities

WSO2 Identity Server IS is a product of the American company WSO2. WSO2 Identity Server is an identity authentication server. WSO2 Identity Server as a Key Manager serves as an identity server. WSO2 Open Banking IAM is an identity and access management solution for the open banking sector. Severa...