CVE-2025-68722

CVE-2025-68722: Axigen WebAdmin CSRF Vulnerability Summary Critical state-changing actions in the Axigen WebAdmin interface are accessible via GET requests. While the h token protects against direct CSRF, the application processes queued requests via the s breadcrumb parameter immediately after a...

CVE-2026-83589

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...

CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...

CVE-2026-83589

A flaw in oauth-proxy allows for an open redirect due to insufficient validation of the destination redirect parameter (rd) during post-login redirection. Specifically, the application may be susceptible to bypasses using // and / sequences. A remote attacker can exploit this by tricking a user i...

CVE-2026-83589 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...

CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

DEBIAN-CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

UBUNTU-CVE-2026-67236

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

EUVD-2026-87141

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

CVE-2026-67236

The messaging and streaming broker RabbitMQ is vulnerable in versions 4.2.0 through 4.2.8 and 4.3.2 . A successful POST /login request causes the is_authorized/2 function to set an authentication cookie containing base64-encoded username and password credentials. These cookies lack HttpOnly , Sec...

Linux Distros Unpatched Vulnerability : CVE-2026-67236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing...

PT-2026-98893

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.7 RabbitMQ versions 4.3.0 through 4.3.1 Description A successful request to the 'POST /login' endpoint causes the is authorized/2 function to set an authentication cookie containing base64-encoded username a...

GHSA-FRCH-4W6V-Q5XX lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightragserver.py:2161 @app.post"/login" async def loginformdata: OAuth2PasswordRequestForm =...

CVE-2026-85734

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

EUVD-2026-84548

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

CVE-2026-85734: Improper Restriction of Excessive Authentication Attempts

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...