8259 matches found
CVE-2026-53514: Improper Authentication
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation,...
CVE-2026-52893: Improper Authentication
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking emailverified. An attacker...
CVE-2026-12281: Improper Authentication
The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...
CVE-2026-44986: Improper Authentication
Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teamsinvitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session base...
CVE-2026-53512: Improper Authentication
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refreshtoken grant authenticates only possession of the bound refreshToken row and matching clientid, without verifying the...
CVE-2026-55652: Improper Authentication
Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADERLOGINTRUSTEDIPS uses getRequestIp in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADERLOGINID f...
CVE-2026-55445: Improper Authentication
Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite'/open/', '/api/$1' rewrites the whitelisted /open/ path after JWT...
CVE-2026-61436: Improper Authentication
PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...
EUVD-2026-43944
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network...
EUVD-2026-44044
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
EUVD-2026-43757
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network...
EUVD-2026-44028
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-50365
Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network...
CVE-2026-56185
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network...
CVE-2026-56169
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-50338
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-50338
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...
CVE-2026-56185
CVE-2026-56185 describes an information-disclosure issue in Windows Admin Center caused by improper authentication. The documented impact is that an authorized attacker can disclose information over a network, with a CVSS 3.1 base score of 6.5 (Network attack vector, Low attack complexity, Low pr...
