EUVD-2026-73327

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

Spring Cloud Azure Elevation of Privilege Vulnerability

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

Microsoft Authenticator Elevation of Privilege Vulnerability

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

PT-2026-87760

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69854: Improper Authentication

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-79576: Improper Authentication

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-86810: Improper Authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-78560: Improper Authentication

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-86669: Improper Authentication

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...

PT-2026-88457

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

PT-2026-88153

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...

PT-2026-88052

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

CVE-2026-80097: Improper Authentication

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

CVE-2026-82758

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

EUVD-2026-72540

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758

ash_authentication_oauth2_server (ash-project, Elixir) has an Improper Authentication flaw in resolve_secret/3: any secret-provider return other than {:ok, _} or :error was treated as valid, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value,...

EEF-CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Summary Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...