Base de CVEs

CVE-2026-33716 Crítica · 9.4 CWE-287 23/03/2026

AVideo: bypass de autenticação no controle de transmissões ao vivo via substituição da URL de verificação de token

WWBN AVideo é uma plataforma de vídeo de código aberto. Nas versões até e incluindo 26.0, o endpoint independente de controle de transmissões ao vivo em plugin/Live/standAloneFiles/control.json.php aceita um parâmetro streamerURL fornecido pelo usuário, que substitui o destino das requisições de verificação de token. Um atacante pode redirecionar a verificação de token para um servidor sob seu controle que sempre retorna {"error": false}, contornando completamente a autenticação. Isso concede controle não autenticado sobre qualquer transmissão ao vivo da plataforma, incluindo derrubar publicadores ativos, iniciar e parar gravações e verificar a existência de transmissões. O commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contém um patch.

CVE-2026-33512 Alta · 7.5 CWE-287 23/03/2026

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.

CVE-2026-4592 Média · 5.6 CWE-287 23/03/2026

kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication

A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of the file /workspace/source-code/plugins/client/controller/tfa/index.class.php of the component Password Login. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-4587 Baixa · 3.7 CWE-287 23/03/2026

HybridAuth SSL Curl.php certificate validation

A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpClient/Curl.php of the component SSL Handler. The manipulation of the argument curlOptions results in improper certificate validation. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-4583 Média · 5.0 CWE-287 23/03/2026

Shenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay

A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth Handler. Performing a manipulation results in authentication bypass by capture-replay. The attack must originate from the local network. The attack is considered to have high complexity. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-4582 Média · 5.0 CWE-287 23/03/2026

Shenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication

A security vulnerability has been detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this vulnerability is an unknown functionality of the component Bluetooth. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. Attacks of this nature are highly complex. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-4562 Alta · 7.3 CWE-287 22/03/2026

MacCMS Timming API Endpoint Timming.php weak authentication

A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component Timming API Endpoint. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVE-2026-2756 Média · 5.0 CWE-287 21/03/2026

OmniPEMF NeoRhythm BLE missing authentication

A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. This affects an unknown function of the component BLE Interface. Such manipulation leads to missing authentication. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-32305 Média · 5.3 CWE-287 20/03/2026

Traefik mTLS bypass via fragmented ClientHello SNI extraction failure

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.

CVE-2026-33124 Alta · 8.8 CWE-287 20/03/2026

Frigate has insecure password change functionality

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-beta1 allow any authenticated user to change their own password without verifying the current password through the /users/{username}/password endpoint. Changing a password does not invalidate existing JWT tokens, and there is no validation of password strength. If an attacker obtains a valid session token (e.g., via accidentally exposed JWT, stolen cookie, XSS, compromised device, or sniffing over HTTP), they can change the victim’s password and gain permanent control of the account. Since password changes do not invalidate existing JWT tokens, session hijacks persist even after a password reset. Additionally, the lack of password strength validation exposes accounts to brute-force attacks. This issue has been resolved in version 0.17.0-beta1.

CVE-2026-4476 Média · 6.3 CWE-287 20/03/2026

Yi Technology YI Home Camera CGI Endpoint ipc missing authentication

A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file home/web/ipc of the component CGI Endpoint. Performing a manipulation results in missing authentication. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-32815 Alta · 7.5 CWE-287 19/03/2026

SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when specific URL parameters are provided (?app=siyuan&id=auth&type=auth). This bypass, intended for the login page to keep the kernel alive, allows any external client — including malicious websites via cross-origin WebSocket — to connect and receive all server push events in real-time. These events leak sensitive document metadata including document titles, notebook names, file paths, and all CRUD operations performed by authenticated users. Combined with the absence of Origin header validation, a malicious website can silently connect to a victim's local SiYuan instance and monitor their note-taking activity. This issue has been fixed in version 3.6.1.

CVE-2025-14716 Média · 6.5 CWE-287 19/03/2026

Unauthorized access to information

Improper Authentication vulnerability in Secomea GateManager (webserver modules) allows Authentication Bypass.This issue affects GateManager: 11.4;0.

CVE-2026-32730 Alta · 8.1 CWE-287 18/03/2026

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authenticated bearer tokens. This completely bypasses multi-factor authentication for any ApostropheCMS deployment using `@apostrophecms/login-totp` or any custom `afterPasswordVerified` login requirement. Version 4.28.0 fixes the issue.

CVE-2026-33042 Média · 5.3 CWE-287 18/03/2026

Parse Server affected by empty authData bypassing credential requirement on signup

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. This allows the creation of authenticated sessions without proper credentials, even when anonymous users are disabled. The fix in 9.6.0-alpha.29 and 8.6.49 ensures that empty or non-actionable `authData` is treated the same as absent `authData` for the purpose of credential validation on new user creation. Username and password are now required when no valid auth provider data is present. As a workaround, use a Cloud Code `beforeSave` trigger on the `_User` class to reject signups where `authData` is empty and no username/password is provided.

CVE-2026-2991 Alta · 7.3 CWE-287 18/03/2026

KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token before authenticating a user. This makes it possible for unauthenticated attackers to log in as any patient registered on the system by providing only their email address and an arbitrary value for the access token, bypassing all credential verification. The attacker gains access to sensitive medical records, appointments, prescriptions, and billing information (PII/PHI breach). Additionally, authentication cookies are set before the role check, meaning the auth cookies for non-patient users (including administrators) are also set in the HTTP response headers, even though a 403 response is returned.

CVE-2026-25937 Média · 6.5 CWE-287 17/03/2026

GLPI has a MFA bypass

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, a malicious actor with knowledge of a user's credentials can bypass MFA and steal their account. Version 11.0.6 fixes the issue.

CVE-2026-4349 Média · 5.6 CWE-287 17/03/2026

Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication

A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-4252 Crítica · 9.8 CWE-287 16/03/2026

Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

A vulnerability was identified in Tenda AC8 16.03.50.11. Affected by this issue is the function check_is_ipv6 of the component IPv6 Handler. The manipulation leads to reliance on ip address for authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVE-2026-4187 Média · 5.3 CWE-287 16/03/2026

Tiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authentication

A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInfo.jsp of the component Device Identifier Handler. Such manipulation of the argument username/password leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-21004 Média · 6.5 CWE-287 16/03/2026

Improper Authentication em Samsung Smart Switch

Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial of service.

CVE-2026-32246 Alta · 7.1 CWE-287 12/03/2026

Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending session (password verified, TOTP not yet completed) to obtain authorization codes. An attacker who knows a user's password but not their TOTP secret can obtain valid OIDC tokens, completely bypassing the second factor. This vulnerability is fixed in 5.0.3.

CVE-2026-32136 Crítica · 9.8 CWE-287 11/03/2026

AdGuard Home: bypass de autenticação via upgrade h2c em texto claro

AdGuard Home é um software de rede para bloqueio de anúncios e rastreamento. Antes da versão 0.107.73, um atacante remoto não autenticado pode contornar toda a autenticação do AdGuardHome enviando uma requisição HTTP/1.1 que solicita upgrade para HTTP/2 em texto claro (h2c). Uma vez aceito o upgrade, a conexão HTTP/2 resultante é tratada pelo mux interno, que não tem middleware de autenticação associado. Todas as requisições HTTP/2 subsequentes nessa conexão são processadas como totalmente autenticadas, independentemente de credenciais terem sido fornecidas. Esta vulnerabilidade está corrigida na versão 0.107.73.

CVE-2026-1524 Crítica · 9.8 CWE-287 11/03/2026

Neo4j Enterprise Edition: autenticação inadequada com múltiplos provedores SSO habilitados

Um caso limite na implementação de SSO no Neo4j Enterprise Edition, nas versões anteriores à 2026.02, pode levar a acesso não autorizado nas seguintes condições: Se um administrador do neo4j configurar dois ou mais provedores OIDC E configurar um ou mais deles como provedor de autorização E configurar um ou mais deles como somente autenticação, então aqueles configurados somente para autenticação também fornecerão autorização. Esse caso limite só se torna um problema de segurança se o provedor somente de autenticação contiver grupos com privilégios superiores aos fornecidos pelo provedor de autorização pretendido (configurado). Ao usar múltiplos plugins para autenticação e autorização, antes da correção o problema podia levar a um plugin configurado para fornecer apenas capacidades de autenticação ou de autorização fornecer ambas as capacidades por engano. Recomendamos atualizar para as versões 2026.02 (ou 5.26.22), nas quais o problema foi corrigido.

CVE-2026-23813 Crítica · 9.8 CWE-287 11/03/2026

Bypass de autenticação na interface web do HPE AOS-CX permite redefinir senha de administrador sem login

Foi identificada uma vulnerabilidade na interface de gerenciamento web baseada em navegador dos switches AOS-CX que pode permitir que um ator remoto não autenticado contorne os controles de autenticação existentes. Em alguns casos, isso pode possibilitar a redefinição da senha de administrador.