CVE-2026-49757 OAuth2/OIDC account takeover in AshAuthentication via email-based user matching

Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address an upsert on the email field, or a user-defined sign-in...

PT-2026-49202

Name of the Vulnerable Software and Affected Versions ash authentication versions 0.1.0 through 4.13.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.9 Description An authentication bypass by spoofing allows account takeover of local users during OAuth2 or OIDC sign-in. The issue occurs...

EUVD-2019-4720

Malware in sbrugna...

EUVD-2019-4697

Malware in sbrugna...

CVE-2021-25985 FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985 FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover

Red Hat Satellite's external authentication component is vulnerable to a full account takeover flaw. This flaw allows an attacker with an authenticated account on Single sign-on SSO to gain elevated privileges of existing local users. This issue only affects users who have configured Satellite to...

CVE-2019-13199

Some Kyocera printers such as the ECOSYS M5526cdw 2R72000.001.701 did not implement any mechanism to avoid CSRF. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device...

CVE-2019-13199

Some Kyocera printers such as the ECOSYS M5526cdw 2R72000.001.701 did not implement any mechanism to avoid CSRF. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device...

CVE-2019-13170

Some Xerox printers such as the Phaser 3320 V53.006.16.000 did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device...

CVE-2019-13170

Some Xerox printers such as the Phaser 3320 V53.006.16.000 did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device...

CVE-2019-13170

CVE-2019-13170 affects Xerox printers (notably Phaser 3320 with firmware version V53.006.16.000) where CSRF protection was not implemented. The root cause is absence of CSRF defenses, enabling an attacker to exploit requests and potentially take over a local device account. Public documents confi...

CVE-2019-13199

Some Kyocera printers such as the ECOSYS M5526cdw 2R72000.001.701 did not implement any mechanism to avoid CSRF. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device...

CVE-2019-13199

CVE-2019-13199 affects Kyocera ECOSYS M5526CDW (example 2R7_2000.001.701). The CSRF protection is not implemented, enabling exploitation that can lead to takeover of a local account on the device. Multiple sources (NVD, Red Hat, CNVD, CNVD-derived entries, PRION, CVE listing) describe the vulnera...