Emby Server Improper Authentication Vulnerability (GHSA-95fv-5gfj-2r84)

Emby Server is prone to an improper authentication vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Improper Authentication

Strapi is vulnerable to improper authentication. The vulnerability is due to JSON Web Tokens not being invalidated after logout or deactivation, along with a publicly accessible /admin/renew-token endpoint, which allows an attacker to reuse or indefinitely renew stolen tokens to maintain...

CVE-2025-66515: Improper Authentication

The Nextcloud Approval app allows approval or disapproval of files in the sidebar. Prior to 1.3.1 and 2.5.0, an authenticated user listed as a requester in a workflow can set another user’s file into the “pending approval” without access to the file by using the numeric file id. This vulnerabilit...

CVE-2025-64055: Improper Authentication

An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device e.g. file upload, firmware update, reboot... via a crafted authentication bypass...

CVE-2025-59704: Improper Authentication

Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 patched in 13.6.12 LTS and 13.9.0 STS, allow an attacker to gain access the the BIOS menu because is has no password...

Improper Authentication

python-social-auth is vulnerable to Improper Authentication. The vulnerability is due to automatic user association by email even when the associatebyemail pipeline is not enabled, where unvalidated or non-unique emails provided by third-party authentication services can be linked to existing...

The vulnerability of the OFTP Request Handler component of the FortiAnalyzer security event monitoring and analysis software allows a perpetrator to trigger a service failure.

The vulnerability of the OFTP Request Handler component of the FortiAnalyzer security event monitoring and analysis software is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to trigger service interruptions...

Exploit for CVE-2025-9803

Lab: CVE-2025-9803 - Improper Authentication in lunary-ai/luna...

CVE-2025-9803 Improper Authentication in lunary-ai/lunary

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' audience field in the access token issued by Google, which is crucial for ensuring the token is intended for the...

CVE-2025-9803: Improper Authentication

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' audience field in the access token issued by Google, which is crucial for ensuring the token is intended for the...

Improper Authentication

Akka.NET is vulnerable to improper authentication. The vulnerability is due to the lack of mutual TLS enforcement in Akka.Remote, which allows an attacker to connect to a TLS-enabled cluster without presenting a valid client certificate and thereby communicate with the cluster...

Exploit for Improper Authentication in Oracle Concurrent_Processing

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle just disclose...

CVE-2025-63207: Improper Authentication

The R.V.R Elettronica TEX product firmware TEXL-000400, Web GUI TLAN-000400 is vulnerable to broken access control due to improper authentication checks on the /Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting ...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the checkAutoLinking function, when auto-linking was enabled for an IdP, there was no verification to ensure that linking to the identified user was permitted.. An attacker can gain unauthorized access to an...

CVE-2024-21635: Improper Authentication

Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update the...

CVE-2025-12998

Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5...

WordPress plugin LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-64717: Improper Authentication

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers to existing users in ZITADEL even if the corresponding Id...

Siemens RUGGEDCOM ROX, SIMATIC S7-1500 Improper Authentication (CVE-2022-22576)

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2025-11566

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint...