Base de CVEs

CVE-2026-36727 Crítica · 9.1 CWE-287 09/06/2026

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars…

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.

CVE-2026-49848 Média · 4.3 CWE-287 09/06/2026

FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's check_auth userauth branch wrote request-supplied userVariables into the connection state before comparing the supplied password. The writes are append-only and the connection is not closed on a failed compare, so values declared on bad-password attempts persisted on the same WebSocket and carried into a subsequent successful login on that connection. This issue has been patched in version 1.11.1.

CVE-2026-49843 Média · 5.3 CWE-287 09/06/2026

FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, mod_verto's JSON-RPC handler bound the connection to the client-supplied sessid on the first frame, before the authentication gate. Binding inserts the connection into the global session hash and, on a key collision, drops the prior occupant of that slot — sending it a verto.punt, detaching its calls, and closing its socket. An unauthenticated network attacker who knows a target session UUID could therefore evict the legitimate client. This issue has been patched in version 1.11.1.

CVE-2026-44810 Alta · 7.8 CWE-287 09/06/2026

Microsoft Cryptographic Services Elevation of Privilege Vulnerability

Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.

CVE-2026-41720 Alta · 7.4 CWE-287 09/06/2026

Authentication Bypass with Empty Password in Spring LDAP

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

CVE-2026-11618 Alta · 7.3 CWE-287 09/06/2026

DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication

A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java of the component Source Connection Test Endpoint. Executing a manipulation can lead to improper authentication. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called f95389e7f74acec42bcee079a616aaa06f9551d2. A patch should be applied to remediate this issue.

CVE-2026-50751 Crítica · 9.3 KEV Urgente · 83 Exploit público Ransomware CWE-287 08/06/2026

Check Point Security Gateway Improper Authentication Vulnerability

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

CVE-2026-34123 Alta · 7.0 CWE-287 05/06/2026

Whitelist Validation Bypass in TP-Link Tapo C520WS

On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensitivity operations. Due to a logic flaw in the device’s API authorization mechanism, an attacker can craft requests that leverage legitimate “method mapping” behavior to bypass whitelist restrictions, allowing restricted operations to be masked as permitted requests and executed. Successful exploitation may allow an attacker (with access to a restricted account) to execute unauthorized sensitive operations. Depending on the operation invoked, impact could include device resets, unintended configuration changes, or disruption of normal operation, leading to loss of availability and integrity of the device.

CVE-2026-46389 Crítica · 9.8 CWE-287 05/06/2026

Bypass de autenticação de cliente no UDS Identity Config (ClientIdAndKubernetesSecretAuthenticator)

O UDS Identity Config gera a imagem de configuração do Keycloak (realm, plugins, tema, truststore, JARs) consumida pela implantação de Identity do UDS Core. Nas versões 0.11.0 até 0.26.0, um erro de lógica no autenticador de cliente client-kubernetes-secret do Keycloak (distribuído pelo uds-identity-config e consumido pelo UDS Core) faz com que o client_secret enviado seja sobrescrito pelo segredo Kubernetes montado antes da comparação. Um atacante que consiga acessar o endpoint de token do Keycloak e conheça um client_id que usa esse autenticador pode autenticar-se como esse cliente com qualquer valor de client_secret e obter tokens OAuth2 com escopo da conta de serviço do cliente. No caso do cliente uds-operator, esse token pode ser usado para registrar/modificar outros clientes. A versão 0.26.1 corrige o problema.

CVE-2026-11345 Média · 6.9 CWE-287 05/06/2026

Improper Authentication Bypass in linqi CDN File Access

An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.

CVE-2026-6274 Crítica · 9.8 CWE-287 05/06/2026

Bypass de autenticação no Redline WR3200 da DTS Electronics

Autenticação imprópria, autenticação ausente para função crítica, autenticação fraca na DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 permite Acesso a Funcionalidade Não Devidamente Restrita por ACLs. Este problema afeta Redline WR3200: de 7.1.3 antes de 7.1.8.

CVE-2023-5502 Média · 5.9 CWE-287 04/06/2026

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.

CVE-2026-49203 Alta · 8.3 CWE-287 04/06/2026

Unauthenticated eSIM Configuration Manipulation

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

CVE-2026-49202 Alta · 8.6 CWE-287 04/06/2026

Unverified Meeting Recording Endpoints & Permissive CORS

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.

CVE-2026-49194 Alta · 8.8 CWE-287 04/06/2026

SCREEN_CLICK Authentication Bypass

The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.

CVE-2026-49191 Crítica · 9.8 CWE-287 04/06/2026

Exposed Hard-coded M3WebServer Backend API Key

The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.

CVE-2026-49186 Crítica · 9.8 CWE-287 04/06/2026

Broker MQTT do Acer Connect M6E 5G sem ACLs por tópico

O broker MQTT local não aplica Listas de Controle de Acesso (ACLs) em nível de tópico. Isso permite que qualquer cliente se inscreva usando caracteres curinga (# ou +) para enumerar dispositivos de rede ocultos ou publicar comandos de controle falsos.

CVE-2026-10777 Alta · 7.3 CWE-287 03/06/2026

ealpha072 Student-Management-System Administrative Backend config.php improper authentication

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-49448 Crítica · 9.8 CWE-287 02/06/2026

authentik: contorno do estágio Source via POST vazio

authentik é um provedor de identidade de código aberto. Antes das versões 2025.12.6, 2026.2.4 e 2026.5.1, o estágio Source pode ser contornado enviando um POST vazio. Este problema foi corrigido nas versões 2025.12.6, 2026.2.4 e 2026.5.1.

CVE-2026-49443 Alta · 8.8 CWE-287 02/06/2026

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

CVE-2026-45289 Média · 5.3 CWE-287 02/06/2026

CloudburstMC Protocol: Partially missing validation for FULL type authentication tokens

CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526-15, CloudburstMC Protocol is partially missing validation for FULL type authentication tokens (Cloudburst/Protocol). This vulnerability impacts publicly accessible software depending on the affected versions of Protocol, specifically the EncryptionUtils methods to validate auth payloads for FULL type tokens. This issue has been patched in version 3.0.0.Beta12-20260420.182526-15.

CVE-2026-10619 Alta · 7.3 CWE-287 02/06/2026

sayan365 student-management-system improper authentication

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-5076 Crítica · 9.8 CWE-287 02/06/2026

ARMember Premium - Mecanismo de redefinição de senha inseguro com possível tomada de conta sem autenticação (até 7.3.1)

O plugin ARMember Premium para WordPress é vulnerável a um mecanismo inseguro de redefinição de senha em todas as versões até a 7.3.1, inclusive. O plugin armazena uma cópia em texto puro da chave de redefinição de senha no campo de metadados de usuário `arm_reset_password_key` quando um usuário solicita a redefinição de senha. Isso ocorre além da chave com hash que o núcleo do WordPress armazena com segurança em `wp_users.user_activation_key`. A chave em texto puro armazenada em `wp_usermeta` pode ser usada com a ação personalizada `armrp` do plugin para definir uma nova senha para qualquer usuário. Combinado com outra vulnerabilidade, como a injeção de SQL (CVE-2026-5073, CVE-2026-5074), isso torna possível que atacantes não autenticados extraiam a chave de redefinição em texto puro e assumam o controle de qualquer conta de usuário, incluindo administradores.

CVE-2026-10617 Alta · 7.3 CWE-287 02/06/2026

nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

CVE-2026-10611 Crítica · 10.0 CWE-287 02/06/2026

Bypass de OTP via autenticação por plugin LDAP no MISP em modo de autenticação mista

Existe uma vulnerabilidade de bypass de autenticação no MISP quando a autenticação mista LDAP está habilitada com imposição de OTP. Em implantações configuradas com LdapAuth.mixedAuth=true e Security.require_otp=true, usuários autenticados por meio de um plugin de autenticação, como o LDAP, podem ter a sessão autenticada estabelecida durante a fase beforeFilter da aplicação, antes que o fluxo normal de login imponha o desafio OTP. Como resultado, um atacante com credenciais de autenticação primária válidas poderia contornar a etapa OTP obrigatória ao autenticar pelo fluxo de login baseado em plugin e, em seguida, acessar diretamente outra URL da aplicação em vez de concluir a página de verificação OTP. Isso permite acesso à aplicação como o usuário afetado sem fornecer um código TOTP, HOTP ou OTP por e-mail válido. O problema afeta configurações em que a autenticação baseada em plugin está habilitada e o OTP deve ser obrigatório. A correção garante que os requisitos de OTP sejam verificados imediatamente após a autenticação via plugin e antes que a sessão do usuário seja estabelecida, redirecionando os usuários para o desafio OTP apropriado quando necessário.