CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

EUVD-2026-86324

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-57177

The python-social-auth (social-auth-core) library is vulnerable to Login CSRF in versions prior to 5.0.0 due to a missing state parameter validation in the LoginRadius backend . An attacker can trick a victim's browser into completing an authentication flow using an attacker-controlled token, res...

CVE-2026-57177 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57177 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

EUVD-2026-86311

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57177 social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

WordPress Easy Hide Login plugin < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure vulnerability

Login Page Protection Bypass / Hidden URL Disclosure vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Easy Hide Login versions 1.7...

WordPress EthPress – Web3 Login plugin <= 2.3.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Thatchapol Booranatanit AliceZz in WordPress Plugin EthPress – Web3 Login versions = 2.3.5...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.4.0 - Subscriber+ Cross-User Account Takeover vulnerability

Subscriber+ Cross-User Account Takeover vulnerability discovered by vuxvinh in WordPress Plugin WP OAuth Server versions 6.4.0...

Updated kbd packages fix a security vulnerability

Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login. CVE-2026-72693...

MGASA-2026-0444 Updated kbd packages fix a security vulnerability

Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login. CVE-2026-72693...

CVE-2026-96773

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

EUVD-2026-85760

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773 Intelliants Subrion CMS Login Page login.php authorize redirect

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-96773

A vulnerability exists in Intelliants Subrion CMS versions up to 4.2.1 . The flaw resides in the iaUsers::authorize function within the front/login.php file of the Login Page component. By manipulating the $_SERVER['HTTP_REFERER'] argument, a remote attacker can trigger an open redirect . Public ...

CVE-2026-96773 Intelliants Subrion CMS Login Page login.php authorize redirect

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...