Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed the issue where krb5 mounts failed when the client tried to mount shares with incorrect credentials. It turned out that the client was reusing the SMB session from the first mount attempt, even though a differe...

CVE-2026-105690: Insufficient Session Expiration

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...

GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...

PT-2026-105606

ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...

EUVD-2026-88580

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

ZITADEL: MFA bypass via session reuse in Login V2

Summary A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor TOTP, OTP, or U2F. An attacker who already knows valid credentials can fully authenticate to an applicatio...

GHSA-9993-RFWP-RHWF ZITADEL: MFA bypass via session reuse in Login V2

Summary A vulnerability in ZITADEL’s Login V2 UI allowed a password-verified browser session to be reused for a new authentication request without re-checking a user’s enrolled second factor TOTP, OTP, or U2F. An attacker who already knows valid credentials can fully authenticate to an applicatio...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

CVE-2026-85056

The identity management platform ZITADEL is vulnerable to an MFA bypass in Login V2 (versions 4.0.0 through 4.16.1). The root cause is that the system creates a browser session after password verification and allows it to be reused for subsequent requests without verifying enrolled TOTP, OTP, or ...

CVE-2026-85056 ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA...

PT-2026-98200

Name of the Vulnerable Software and Affected Versions ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Login V2 creates a browser session immediately after password verification. This session can be reused for subsequent authentication requests without verifying a user's enrolled second...

CVE-2026-77268

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77268

The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to insecure file permissions in versions prior to 0.22.0 . The application creates the OAuth fallback token directory and JSON file without explicit owner-only modes. This allows local users or processes with gr...

EUVD-2026-84757

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...