Tag
#Authentication Bypass
Eclipse Jetty Digest Authentication Bypass via Character Substitution
CVE-2026-10050 is an authentication bypass vulnerability in Eclipse Jetty's Digest authentication implementation. The vulnerability arises from the use of ISO-8859-1 encoding, which replaces characters outside the Latin-1 range with '?' characters, leading to collisions in Digest authentication response hashes. This allows an attacker to bypass authentication for users with non-Latin-1 passwords.
LiteLLM MCP Authentication Bypass via OAuth2 Passthrough Fallback (CVE-2026-59822)
LiteLLM's MCP Streamable HTTP endpoint is vulnerable to an authentication bypass attack via OAuth2 passthrough fallback, allowing an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. This issue is fixed in version 1.84.0. A CVSS score of 8.8 indicates high severity.
Critical Authentication Bypass Vulnerability in Check Point SmartConsole (CVE-2026-16232)
A critical authentication bypass vulnerability (CVE-2026-16232) has been discovered in Check Point SmartConsole, allowing unauthenticated remote attackers to obtain application login tokens and gain full administrative privileges. This vulnerability has a CVSS score of 9.1 and is actively being exploited. Affected products include various versions of Check Point Quantum Security Management and Multi-Domain Security Management. Immediate patching or mitigation is strongly recommended.
Critical Authentication Bypass Vulnerability in VMware Avi Load Balancer (CVE-2026-47865)
A critical authentication bypass vulnerability (CVE-2026-47865) has been discovered in VMware Avi Load Balancer, with a CVSS score of 9.8. The vulnerability allows a malicious user with network access to bypass the authentication mechanism and access the Avi Control plane. Affected versions include 31.1.1 through 31.2.2, 30.1.1 through 30.2.6, and 22.1.1 through 22.1.7. Immediate patching is recommended to prevent potential exploitation.
Critical Unverified Password Change Vulnerability in Vimesoft Inc. Enterprise Video Platform (CVE-2026-12692)
A critical unverified password change vulnerability (CVE-2026-12692) with a CVSS score of 9.8 affects Vimesoft Inc.'s Enterprise Video Platform versions 3.11.0.0 to 3.24.0. This vulnerability allows for authentication bypass and could lead to severe impacts including high confidentiality, integrity, and availability risks. Immediate action is required to update to version 3.25.0 or later.
Critical Vulnerability in Siemens Opcenter X Allows Arbitrary JWT Forging
A critical vulnerability (CVE-2026-56451) with a CVSS score of 10 has been identified in Siemens Opcenter X versions prior to V2604. This vulnerability allows an unauthenticated remote attacker to forge arbitrary JSON Web Tokens (JWT), bypass authentication mechanisms, and impersonate any user, including administrative accounts. Immediate action is required to update affected systems.
CVE-2026-14245: Critical Authentication Bypass in miniOrange OTP Login, Verification and SMS Notifications Plugin
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover. This vulnerability, with a CVSS score of 9.8, allows unauthenticated attackers to take control of an arbitrary Administrator account. The plugin's flawed implementation of the password reset process enables attackers to obtain a freshly generated password-reset URL for an Administrator account. Immediate patching is recommended.
CVE-2026-14495: Critical Authentication Bypass in DoLogin Security Plugin for WordPress
The DoLogin Security plugin for WordPress is vulnerable to authentication bypass due to insufficient randomness in all versions up to and including 4.3. This vulnerability allows unauthenticated attackers to brute-force a limited seed space and reconstruct active passwordless login tokens, enabling them to authenticate as any targeted user, including administrators, without a password. The vulnerability has a CVSS score of 8.8 and requires a valid, unexpired passwordless login link to exist for the target account. Immediate patching is recommended.
Critical Authentication Bypass Vulnerability in Rancher GitHub Authentication Provider (CVE-2026-41053)
A critical vulnerability (CVE-2026-41053) with a CVSS score of 8.8 was discovered in the Rancher GitHub authentication provider. This vulnerability allows for incorrect authentication caching, granting principal access to any logged-in user. Affected versions include Rancher 2.13 before 2.13.6 and 2.14 before 2.14.2. Organizations are urged to upgrade to patched versions immediately to prevent potential authentication bypass attacks.
Understanding and Defending Against CVE-2019-25763: Authentication Bypass in WordPress Ultimate Addons for Beaver Builder
CVE-2019-25763 is a critical authentication bypass vulnerability in WordPress Ultimate Addons for Beaver Builder 1.2.4.1. Attackers can exploit this flaw to gain unauthorized access by manipulating the social media login form functionality. This vulnerability has a CVSS score of 9.8, indicating a high severity threat. Understanding the root cause, attack vector, and defensive strategies is crucial for security practitioners to protect their deployments.