Auth bypass in Cert.pl Mwdb Core
CVE-2026-66723
MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send…
Vulnerability class: Broken Access Control
Affected products
- Cert.pl Mwdb Core — versions 2.2.0
Weakness classification (CWE)
References
- cvd@cert.pl (vendor-advisory)
- cvd@cert.pl (vendor-advisory)
- cvd@cert.pl (patch)