CVE-2026-80097

CVE-2026-80097 is an improper authentication vulnerability in Microsoft Authenticator that allows an unauthorized local attacker to elevate privileges . The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating a local attack with low complexity , no prior ...

EUVD-2026-73327

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

Microsoft Authenticator Elevation of Privilege Vulnerability

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

Spring Cloud Azure Elevation of Privilege Vulnerability

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87760

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69854: Improper Authentication

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-86810: Improper Authentication

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

CVE-2026-79576: Improper Authentication

An issue in the Single-Sign On SSO component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password...

CVE-2026-78560: Improper Authentication

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-86669: Improper Authentication

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...

PT-2026-88457

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely...

PT-2026-88153

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...

CVE-2026-80097: Improper Authentication

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally...

PT-2026-88052

Name of the Vulnerable Software and Affected Versions Microsoft Authenticator affected versions not specified Description Improper authentication allows an unauthorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that contai...

CVE-2026-82758

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

EUVD-2026-72540

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

EEF-CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Summary Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...

CVE-2026-82758

ash_authentication_oauth2_server (ash-project, Elixir) has an Improper Authentication flaw in resolve_secret/3: any secret-provider return other than {:ok, _} or :error was treated as valid, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value,...

CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...