CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...

CVE-2026-7120

The CVE-2026-7120 issue affects @fastify/static (versions up to and including 10.1.1). The root cause is that allowedPath is evaluated before normalizing dot segments and duplicate separators in the request pathname, allowing an unauthenticated attacker to bypass path-based filtering by using equ...

CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...

PT-2026-64205

Name of the Vulnerable Software and Affected Versions Azure Red Hat OpenShift ARO affected versions not specified Description Improper authorization allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version tha...

Logto Identity Platform has authentication and authorization failures in core protocol handling

Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, ...

Incorrect Authorization

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Incorrect Authorization in the enforcement of plugin manager lock rules via direct API requests to /lab/api/plugins. An attacker can circumvent administrative restrictions on enablin...

GHSA-6GPP-XCG3-4W24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview org.eclipse.jetty:jetty-util is a Web Container & Clients - supports HTTP/2, HTTP/1.1, HTTP/1.0, websocket, servlets, and more. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions due to incorrect handling of ; path-parameter...

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Impact LiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

Impact The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. A member-level user can register an OAuth client, self-approve consent for another user's n8n OAuth2-protected MCP...

Incorrect Authorization

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Incorrect Authorization in the OAuth 2.1 authorization. An attacker can gain unauthorized access to another user's workflow and execute it with the owner's credentials by registering an OAuth client and...

EUVD-2026-42268

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects...

GHSA-2XGM-WC4G-5JVG n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

Impact An authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project...

Incorrect Authorization

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Incorrect Authorization via the Execute Sub-workflow. An attacker can access unauthorized credentials by referencing credential IDs within inline workflow JSON, bypassing intended access controls. Note: Thi...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the process that handles credential domain restrictions when user-supplied base or endpoint URLs are set. An attacker can exfiltrate credential secrets by configuring...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the authentication when the embed login feature is enabled and at least one trusted key source is configured. An attacker can gain unauthorized access to any existing user...

CVE-2026-63685 Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially...

CVE-2026-63685

The CVE describes an authorization bypass affecting the Joomla extension DB Replacer from regularlabs.com. The vulnerability arises because Administrator routes and replacement requests did not consistently require Super User permission and a valid token, enabling an unauthorized backend user or ...