Base de CVEs

CVE-2026-45289 Média · 5.3 CWE-287 02/06/2026

CloudburstMC Protocol: Partially missing validation for FULL type authentication tokens

CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526-15, CloudburstMC Protocol is partially missing validation for FULL type authentication tokens (Cloudburst/Protocol). This vulnerability impacts publicly accessible software depending on the affected versions of Protocol, specifically the EncryptionUtils methods to validate auth payloads for FULL type tokens. This issue has been patched in version 3.0.0.Beta12-20260420.182526-15.

CVE-2026-10619 Alta · 7.3 CWE-287 02/06/2026

sayan365 student-management-system improper authentication

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-5076 Crítica · 9.8 CWE-287 02/06/2026

ARMember Premium - Mecanismo de redefinição de senha inseguro com possível tomada de conta sem autenticação (até 7.3.1)

O plugin ARMember Premium para WordPress é vulnerável a um mecanismo inseguro de redefinição de senha em todas as versões até a 7.3.1, inclusive. O plugin armazena uma cópia em texto puro da chave de redefinição de senha no campo de metadados de usuário `arm_reset_password_key` quando um usuário solicita a redefinição de senha. Isso ocorre além da chave com hash que o núcleo do WordPress armazena com segurança em `wp_users.user_activation_key`. A chave em texto puro armazenada em `wp_usermeta` pode ser usada com a ação personalizada `armrp` do plugin para definir uma nova senha para qualquer usuário. Combinado com outra vulnerabilidade, como a injeção de SQL (CVE-2026-5073, CVE-2026-5074), isso torna possível que atacantes não autenticados extraiam a chave de redefinição em texto puro e assumam o controle de qualquer conta de usuário, incluindo administradores.

CVE-2026-10617 Alta · 7.3 CWE-287 02/06/2026

nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bug.

CVE-2026-10611 Crítica · 10.0 CWE-287 02/06/2026

Bypass de OTP via autenticação por plugin LDAP no MISP em modo de autenticação mista

Existe uma vulnerabilidade de bypass de autenticação no MISP quando a autenticação mista LDAP está habilitada com imposição de OTP. Em implantações configuradas com LdapAuth.mixedAuth=true e Security.require_otp=true, usuários autenticados por meio de um plugin de autenticação, como o LDAP, podem ter a sessão autenticada estabelecida durante a fase beforeFilter da aplicação, antes que o fluxo normal de login imponha o desafio OTP. Como resultado, um atacante com credenciais de autenticação primária válidas poderia contornar a etapa OTP obrigatória ao autenticar pelo fluxo de login baseado em plugin e, em seguida, acessar diretamente outra URL da aplicação em vez de concluir a página de verificação OTP. Isso permite acesso à aplicação como o usuário afetado sem fornecer um código TOTP, HOTP ou OTP por e-mail válido. O problema afeta configurações em que a autenticação baseada em plugin está habilitada e o OTP deve ser obrigatório. A correção garante que os requisitos de OTP sejam verificados imediatamente após a autenticação via plugin e antes que a sessão do usuário seja estabelecida, redirecionando os usuários para o desafio OTP apropriado quando necessário.

CVE-2026-8293 Alta · 7.5 CWE-287 02/06/2026

Really Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip

The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.

CVE-2026-10548 Média · 5.3 CWE-287 01/06/2026

NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.23. This affects the function _sync_anthropic_entry_from_credentials_file of the file agent/credential_pool.py of the component Credential Pool Synchronization. The manipulation results in improper authentication. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-40964 Alta · 7.5 CWE-287 01/06/2026

Improper Authentication em Cloud Foundry Foundation Log-cache Release

Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read access to every log and metric for every application and platform component via minting a JWT that the cf-auth-proxy accepts as a valid logs.admin token. Affected versions: - log-cache_release: all versions through v3.2.6 (inclusive); fixed in v3.2.7 or later - CF Deployment: all versions through v55.?.0 (inclusive); fixed in v55.?.0 or later (bundles log-cache_release v3.2.7)

CVE-2026-10288 Alta · 7.3 CWE-287 01/06/2026

code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication

A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVE-2026-45691 Média · 5.9 CWE-287 01/06/2026

Nextcloud: Bypass of second factor authentication on DAV endpoints

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

CVE-2026-45690 Média · 5.9 CWE-287 01/06/2026

Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a temporary session token before enforcing the second factor challenge. This token could be extracted and replayed via HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

CVE-2026-45283 Média · 4.3 CWE-287 01/06/2026

Nextcloud: Files Lock app allows users to lock and unlock files of other users

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.2, and 33.0.0 to before 33.0.1, the files_lock app did not properly validate the ownership of files when processing DAV lock and unlock requests. An authenticated user could lock or unlock files belonging to other users by targeting their absolute WebDAV paths. Additionally, lock tokens were disclosed to unauthorized callers in error responses, allowing attackers to remove token-based locks placed by other users' client applications. It is recommended that the Nextcloud Server is upgraded to 32.0.2 or 33.0.1. It is recommended that the Nextcloud Enterprise Server is upgraded to 31.0.14.4 or 32.0.2 or 33.0.1

CVE-2026-10283 Média · 6.3 CWE-287 01/06/2026

Bottelet DaybydayCRM Setting missing authentication

A vulnerability was detected in Bottelet DaybydayCRM up to 2.2.1. Affected is an unknown function of the component Setting Handler. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. It is recommended to apply a patch to fix this issue.

CVE-2026-10281 Alta · 7.3 CWE-287 01/06/2026

Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication

A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.5.6 mitigates this issue. Patch name: d0b02a800aa0689d9428cc4cc170e0b6589fb2c3. The affected component should be upgraded.

CVE-2026-45156 Alta · 8.1 CWE-287 01/06/2026

Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

CVE-2026-45153 Média · 4.6 CWE-287 01/06/2026

Nextcloud: PIN bypass in PassCodeActivity via back button

Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0.

CVE-2026-10243 Alta · 7.3 CWE-287 01/06/2026

code-projects Smart Parking System Admin Endpoint missing authentication

A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin Endpoint. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

CVE-2026-10167 Alta · 7.3 CWE-287 31/05/2026

OUSL-GROUP-BrinaryBrains School Student Management System MY_Controller Login.php sign_auth_cookie improper authentication

A weakness has been identified in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. This impacts the function sign_auth_cookie of the file application/controllers/Login.php of the component MY_Controller. Executing a manipulation of the argument role can lead to improper authentication. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-10157 Alta · 7.3 CWE-287 30/05/2026

Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication

A vulnerability was identified in Open5GS up to 2.7.6. This impacts an unknown function of the file src/amf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is a188e36b1741ffc2252133f59b1bda4f14d3cb5c. It is suggested to install a patch to address this issue.

CVE-2026-46579 Alta · 7.5 CWE-287 29/05/2026

Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.

CVE-2026-49197 Crítica · 9.8 CWE-287 29/05/2026

Acer Predator Connect W6x: Autenticação Inadequada

Endpoints web destinados ao app Acer Connect validam de forma inadequada o cabeçalho HTTP Authorization, deixando de bloquear requisições quando a decodificação Base64 falha.

CVE-2026-3655 Crítica · 9.8 CWE-287 29/05/2026

Plugin OTP Login With Phone Number para WordPress - Bypass de Autenticação Não Autenticado via Firebase OTP

O plugin OTP Login With Phone Number, OTP Verification para WordPress é vulnerável a bypass de autenticação nas versões de 1.8.50 até 1.8.60. Isso ocorre porque o fluxo de verificação do Firebase no handler AJAX `lwp_ajax_register` não vincula a sessão do Firebase ao número de telefone informado na requisição. A função `idehweb_lwp_activate_through_firebase()` valida que uma sessão OTP do Firebase é legítima, mas o `phoneNumber` retornado pelo Firebase nunca é comparado com o número de telefone armazenado da vítima. Isso torna possível que atacantes não autenticados se autentiquem como qualquer usuário que tenha número de telefone armazenado em user meta, incluindo administradores, ao verificar a própria sessão Firebase e informar o número de telefone da vítima na mesma requisição.

CVE-2026-48526 Alta · 7.4 CWE-287 28/05/2026

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

CVE-2026-8979 Crítica · 9.3 CWE-287 28/05/2026

Bypass de autenticação no Mennekes Amtron

O Mennekes Amtron series (versões de firmware ≤ 5.22.3) é vulnerável a um bypass de autenticação. Um atacante remoto não autenticado pode alterar a senha da conta de usuário por meio de uma requisição POST manipulada para o endpoint /operator/operator.

CVE-2026-44720 Média · 6.9 CWE-287 27/05/2026

OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. This vulnerability is fixed in 2.0.4.