FacturaScripts: Account takeover of any 2FA-enabled user
CVE-2026-47677
# Authentication bypass in FacturaScripts: `/login?action=two-factor-validation` accepts brute-forceable TOTP without pa
#cwe-287
共收录 1081 条相关情报。
← 返回所有主题Apollo ConfigService access key authentication bypass via raw config file appId parsing
CVE-2026-59955
### Summary Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key
Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching
CVE-2026-59954
### Summary Apollo ConfigService may allow unauthorized access to configuration data when AccessKey / management key aut
Decidim: JWT-backed authentication can be replayed across organizations
CVE-2026-45414
## Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL `parti
The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering rebo...
CVE-2026-22099
The charging station does not require authentication for Bluetooth commands to perform actions. The functionality expose
A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjec...
CVE-2026-15557
A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInterna
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. T...
CVE-2026-15542
A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.g
A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to...
CVE-2026-15491
A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects
A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authent...
CVE-2026-15491
A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects
TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation
## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication tok
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for...
CVE-2026-12761
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to auth
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restrict...
CVE-2026-57216
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Str
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions...
CVE-2026-12761
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to auth
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that bel...
CVE-2026-55377
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-
File Browser: Authentication Bypass via Proxy Auth Header Forgery
CVE-2026-54089
## Summary When FileBrowser is configured with proxy authentication (`auth.method=proxy`), any unauthenticated attacker
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should r...
CVE-2026-59151
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asser
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler checks that the local user's email is verified but does not...
CVE-2026-56666
ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's external identity provider handler ch
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify t...
CVE-2026-55672
ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchan
9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that ...
CVE-2026-56675
9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* acce
Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is enforced. Attackers...
CVE-2026-56312
Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user