CWE-287 · Improper Authentication (page 7)
Page 7 of 51 — CVEs classified under CWE-287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12492 | Critical | 9.8 | 2026-07-16 | The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a… |
CVE-2026-55652 | Critical | 9.8 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js t… |
CVE-2026-55445 | | 2026-07-15 | Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/… | |
CVE-2026-52893 | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing a… | |
CVE-2026-46485 | High | 8.2 | 2026-07-15 | Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to w… |
CVE-2026-53516 | High | 8.3 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo… |
CVE-2026-53514 | High | 7.7 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside… |
CVE-2026-53512 | Critical | 9.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoint… |
CVE-2026-59955 | High | 7.5 | 2026-07-15 | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may all… |
CVE-2026-59954 | High | 7.5 | 2026-07-15 | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may all… |
CVE-2026-47159 | | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-relate… | |
CVE-2026-44986 | Critical | 9.9 | 2026-07-15 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-tea… |
CVE-2026-61740 | | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is deployed with LIGHTRAG_API_KEY set but AUTH_ACCOUNTS unset… | |
CVE-2026-61436 | High | 8.6 | 2026-07-15 | PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events… |
CVE-2026-61435 | High | 8.2 | 2026-07-15 | PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISON… |
CVE-2026-56353 | Medium | 4.8 | 2026-07-15 | n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before… |
CVE-2026-12281 | High | 8.1 | 2026-07-15 | The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any requ… |
CVE-2026-5270 | Critical | 9.8 | 2026-07-14 | An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet pr… |
CVE-2026-45363 | Critical | 9.1 | 2026-07-14 | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') acc… |
CVE-2026-45754 | Medium | 5.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridg… |
CVE-2026-50365 | High | 8.0 | 2026-07-14 | Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-57107 | High | 7.8 | 2026-07-14 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally. |
CVE-2026-56185 | Medium | 6.5 | 2026-07-14 | Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network. |
CVE-2026-56169 | High | 8.1 | 2026-07-14 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
CVE-2026-50338 | High | 8.2 | 2026-07-14 | Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network. |
CVE-2026-22099 | | 2026-07-13 | The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakag… | |
CVE-2026-15557 | High | 7.3 | 2026-07-13 | A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUser… |
CVE-2026-15542 | High | 7.3 | 2026-07-13 | A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection… |
CVE-2026-15491 | High | 7.3 | 2026-07-12 | A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation caus… |
CVE-2026-15089 | Critical | 9.1 | 2026-07-10 | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*. |
CVE-2026-15087 | Medium | 5.9 | 2026-07-10 | vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*. |
CVE-2026-57216 | Medium | 6.8 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a… |
CVE-2026-12761 | Critical | 9.8 | 2026-07-10 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account ta… |
CVE-2026-55377 | High | 8.1 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verificati… |
CVE-2026-59151 | Critical | 9.6 | 2026-07-10 | Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding whi… |
CVE-2026-56666 | Medium | 4.8 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is ver… |
CVE-2026-55672 | High | 7.4 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flow… |
CVE-2026-56675 | High | 8.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host r… |
CVE-2026-56312 | Medium | 6.5 | 2026-07-10 | Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is e… |
CVE-2026-12598 | High | 8.1 | 2026-07-10 | The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This i… |
CVE-2026-12597 | High | 8.1 | 2026-07-10 | The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulne… |
CVE-2026-12595 | High | 8.1 | 2026-07-10 | The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulner… |
CVE-2026-55689 | Medium | 6.8 | 2026-07-09 | OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.me… |
CVE-2026-59224 | High | 8.0 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_ter… |
CVE-2026-15192 | Medium | 6.5 | 2026-07-09 | A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhoo… |
CVE-2026-59208 | Medium | 6.8 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-… |
CVE-2026-54781 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not… |
CVE-2026-59822 | High | 8.2 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauth… |
CVE-2026-58253 | High | 8.8 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was c… |
CVE-2026-55761 | Medium | 5.9 | 2026-07-08 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2026-9695 | Critical | 9.8 | 2026-07-08 | An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to th… |
CVE-2026-55076 | High | 7.4 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callb… |
CVE-2026-37271 | Critical | 9.8 | 2026-07-07 | Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without suffi… |
CVE-2026-37270 | Critical | 9.8 | 2026-07-07 | Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-c… |
CVE-2026-55075 | High | 7.4 | 2026-07-07 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder… |
CVE-2026-53483 | Critical | 9.8 | 2026-07-07 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-55727 | High | 7.5 | 2026-07-06 | A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated at… |
CVE-2026-40139 | Critical | 9.8 | 2026-07-06 | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication request… |
CVE-2026-40138 | High | 8.1 | 2026-07-06 | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validat… |
CVE-2026-53913 | Critical | 9.8 | 2026-07-06 | Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. … |
CVE-2026-14714 | Medium | 6.5 | 2026-07-05 | A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common… |
CVE-2026-14627 | Medium | 5.6 | 2026-07-04 | A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gat… |
CVE-2026-12196 | | 2026-07-04 | HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts Hestia… | |
CVE-2026-14622 | High | 7.3 | 2026-07-04 | A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code o… |
CVE-2026-58423 | High | 7.7 | 2026-07-03 | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories |
CVE-2026-52830 | Critical | 9.4 | 2026-07-02 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file… |
CVE-2026-58029 | Medium | 6.5 | 2026-07-01 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/A… |
CVE-2026-58399 | | 2026-07-01 | @acastellon/auth is an authentication control system for microservices. Versions prior to 2.3.0 appear to allow an unauthenticated authentication bypass in val… | |
CVE-2026-11387 | Critical | 9.8 | 2026-07-01 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account… |
CVE-2026-56219 | High | 7.5 | 2026-06-30 | Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrie… |
CVE-2026-10560 | High | 8.2 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated atta… |
CVE-2026-55955 | Medium | 6.5 | 2026-06-29 | Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects… |
CVE-2026-41896 | High | 7.5 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's… |
CVE-2026-13546 | High | 7.3 | 2026-06-29 | A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Perfo… |
CVE-2026-13543 | Medium | 5.6 | 2026-06-29 | A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/h… |
CVE-2026-49869 | Critical | 10.0 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("… |
CVE-2026-55962 | Medium | 6.5 | 2026-06-25 | TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and Cert… |
CVE-2026-11703 | High | 7.5 | 2026-06-25 | Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached sessio… |
CVE-2026-54089 | Critical | 9.1 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc… |
CVE-2026-55759 | High | 7.4 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat'… |
CVE-2026-55666 | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/mete… | |
CVE-2026-13208 | Medium | 6.5 | 2026-06-24 | A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for HandleDomainEvent and HandleK8SEvent derive the VMI identity (namespace… |
CVE-2026-56237 | Critical | 9.1 | 2026-06-24 | Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the ba… |
CVE-2026-56223 | High | 8.7 | 2026-06-24 | Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim… |
CVE-2026-12112 | High | 7.8 | 2026-06-23 | A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrati… |
CVE-2026-54320 | High | 8.4 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be… |
CVE-2026-52845 | High | 8.1 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header b… |
CVE-2026-44961 | Unrated | | 2026-06-23 | The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled imp… |
CVE-2026-34917 | Medium | 4.3 | 2026-06-23 | Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users… |
CVE-2026-11374 | Critical | 9.0 | 2026-06-23 | In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be… |
CVE-2026-7664 | Critical | 9.8 | 2026-06-22 | IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper… |
CVE-2026-10845 | High | 7.3 | 2026-06-22 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications. |
CVE-2026-12795 | High | 7.3 | 2026-06-21 | A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py o… |
CVE-2026-12773 | High | 7.3 | 2026-06-21 | A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth… |
CVE-2026-56345 | High | 8.1 | 2026-06-20 | AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id… |
CVE-2026-56294 | Medium | 4.8 | 2026-06-20 | capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate Crypt… |
CVE-2026-56080 | Medium | 4.9 | 2026-06-19 | Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to… |
CVE-2026-50559 | High | 7.5 | 2026-06-19 | Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus… |
CVE-2026-45480 | Critical | 10.0 | 2026-06-19 | Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-49872 | High | 8.1 | 2026-06-19 | Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credent… |