CVE-2025-13390

CVE-2025-13390 WP Directory Kit WordPress WP Directory Kit 플러그인은 1.4.4 이하 모든 버전에서wdkgenerateautologinlink 함수의 인증 알고리즘 구현 오류로 인해 인증 우회에 취약합니다. 이는 기능이 암호학적으로 취약한 토큰 생성 메커니즘을 사용하기 때문입니다. 이 결함으로 인해 인증되지 않은 공격자 가 예측 가능한 토큰을 이용해 자동 로그인 엔드포인트로 관리자 권한을 획득하고 전체 사이트를 장악 할 수 있습니다. CNA: Wordfence 기본 점수: 10.0...

CVE-2026-9103

CVE-2026-9103 affects Langflow OSS 1.0.0–1.10.0. The root cause is improper authentication in the /api/v1/login/auto_login endpoint, which issues long‑lived superuser tokens when AUTO_LOGIN is enabled (default). Combined with permissive CORS, this can expose tokens to unintended origins and enabl...

CVE-2026-9103 Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...

Security Bulletin: Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

Summary An unauthenticated endpoint in the login API allowed any network-reachable attacker to obtain a 365-day superuser bearer token without requiring any credentials. The /api/v1/login/autologin endpoint issued tokens when the AUTOLOGIN configuration defaulted to True, enabling complete...

CVE-2025-13390

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...

CVE-2025-13390

CVE-2025-13390 affects the WordPress plugin WP Directory Kit, versions up to 1.4.4. The flaw is an authentication bypass caused by a weak token generation in the wdk_generate_auto_login_link function, making tokens predictable and allowing unauthenticated attackers to gain administrative access a...

CVE-2025-13390 WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdkgenerateautologinlink" function. This is due to the feature using a cryptographically weak token...