CVE-2026-56682

9Router versions prior to 0.5.6 are vulnerable to a login brute-force lockout bypass. The application's rate-limiting mechanism, specifically in src/lib/auth/loginLimiter.js, uses the client-supplied X-9r-Real-Ip header as the bucket key for tracking failed login attempts. When deployed without t...

PT-2026-96821

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description In deployments where requests reach Next.js without the sanitizing custom-server.js wrapper, the application uses the client-supplied X-9r-Real-Ip header as the bucket key for rate limiting. This...

CVE-2026-54907: Initialization of a Resource with an Insecure Default

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-59681

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

dovecot: Fix of CVE-2017-15132

CVE-2017-15132: fix memory leak and hash-table use-after-free in authclientrequestabort lib-auth. Squashed upstream commits 1a29ed2f96da and a9b135760aea...

Malicious code in @fe-lib/auth (npm)

The package @fe-lib/auth was found to contain malicious code...

MAL-2025-7934 Malicious code in @fe-lib/auth (npm)

The package @fe-lib/auth was found to contain malicious code...

SQL Injection in SimpleSAMLphp

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php...

CVE-2019-15537: Improper Neutralization of Special Elements used in an SQL Command

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php...

PT-2019-14254

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 3.1.0 Description The issue allows SQL Injection in the proxystatistics module, specifically in the lib/Auth/Process/DatabaseCommand.php file. Recommendations For versions prior to 3.1.0, update to version 3.1.0...

PT-2014-2830

Name of the Vulnerable Software and Affected Versions drupalauth module versions prior to 1.2.2 Description The issue allows remote attackers to authenticate as an arbitrary user via the uid in a cookie. This is due to a flaw in the lib/Auth/Source/External.php file of the drupalauth module for...