CVE-2026-74037

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for runas users with zero static roles, because checktoken never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access...

CVE-2026-74037

Wazuh versions 4.0.0 before 4.14.8 are vulnerable to a Session Invalidation Bypass in the check_token function. The root cause is that the system fails to consult the blacklist when validating issued tokens for run_as users with zero static roles. This allows an attacker with revoked administrato...

CVE-2025-64075: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the checktoken function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value...