PT-2026-98032

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.7 authentik versions prior to 2026.5.7 authentik versions prior to 2026.8.2 Description During an authentication or enrollment flow, the email authenticator accepts a recipient address provided in the setup...

CVE-2026-94606: Improper Authentication

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445

A flaw exists in the Conditional OTP authenticator of Keycloak , an identity and access management solution. The system improperly evaluates specific HTTP headers to decide whether to skip a one-time password (OTP) without verifying if those headers originate from a trusted source . Consequently,...

CVE-2026-96445 Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

EUVD-2026-85223

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445 Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

CVE-2026-96445

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

PT-2026-97286

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Conditional OTP authenticator of Keycloak. The system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped but fails to verify if...

CVE-2026-96445: Improper Authentication

A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password OTP should be skipped, but fails to verify if those headers came from a trusted sourc...

missinglinkai-resource-manager-docker (>=1.0.367, <=2.14.1737), pyne-xmas-elves (>=0.1.0, <=0.7.1) +2 more potentially affected by CVE-2026-77528 via autobahn (17.10.1)

autobahn PYPI version 17.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - missinglinkai-resource-manager-docker =1.0.367, =0.1.0, =0.7.2, =0.7.7, =0.10.1 Source cves: CVE-2026-77528 Source advisory:...

Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .

Summary IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat. The Tomcat version has been updated within IBM ApplinX in order to address the mentioned vulnerabilities. Vulnerability Detail...

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own...

WordPress miniOrange 2FA plugin < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding vulnerability

2FA Bypass via Password-Only Second-Factor Rebinding vulnerability discovered by Artus KG in WordPress Plugin miniOrange's Google Authenticator versions 6.2.7...

keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

Arista Networks EOS 4.36.1F Multiple Vulnerabilities (SA0150)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities as referenced in security advisory SA0150. - On Arista EOS 4.36.1F configured as an 802.1X authenticator with per-supplicant access control lists, an adjacent attacker can trigger an unexpected...

CVE-2026-45051 OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from the configured userAttribute through loadAuthenticators without an ObjectInputFilter. Exploitation requires the WebAuthn flow to be...

Astra Linux – Vulnerability in Tomcat9

Authentication Bypass due to a capture-replay vulnerability in Apache Tomcat’s DIGEST authenticator. If a client makes a DIGEST authenticated request with a nonceCount value exceeding the upper boundary of the replay window before windowSize requests have been made, that request can be replayed...

EUVD-2026-76915

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...