Common Weakness Enumeration
CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
2084 vulnerabilities reference this CWE, most recent first.
CVE-2026-125087 (GCVE-0-2026-125087)
Vulnerability from cvelistv5 – Published: 2026-11-10 01:00 – Updated: 2026-11-10 01:00 X_Open Source
VLAI
EPSS
VEX
Title
Michael-A-Kuykendall Shimmy Inference API server.rs missing authentication
Summary
A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component.
Severity
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433198 | vdb-entry |
| https://vuldb.com/vuln/433198/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-125087 | third-party-advisory |
| https://vuldb.com/submit/1042415 | third-party-advisory |
| https://github.com/Michael-A-Kuykendall/shimmy/is… | issue-tracking |
| https://github.com/Michael-A-Kuykendall/shimmy/co… | patch |
| https://github.com/Michael-A-Kuykendall/shimmy/re… | patch |
| https://github.com/Michael-A-Kuykendall/shimmy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Michael-A-Kuykendall | Shimmy |
Affected:
2.6.0
Affected: 2.6.1 Affected: 2.6.2 Affected: 2.6.3 Affected: 2.6.4 Unaffected: 2.6.5 cpe:2.3:a:michael-a-kuykendall:shimmy:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:michael-a-kuykendall:shimmy:*:*:*:*:*:*:*:*"
],
"modules": [
"Inference API"
],
"product": "Shimmy",
"vendor": "Michael-A-Kuykendall",
"versions": [
{
"status": "affected",
"version": "2.6.0"
},
{
"status": "affected",
"version": "2.6.1"
},
{
"status": "affected",
"version": "2.6.2"
},
{
"status": "affected",
"version": "2.6.3"
},
{
"status": "affected",
"version": "2.6.4"
},
{
"status": "unaffected",
"version": "2.6.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "geochen (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T01:00:27.382Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433198 | Michael-A-Kuykendall Shimmy Inference API server.rs missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/433198"
},
{
"name": "VDB-433198 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433198/cti"
},
{
"name": "CVE-2026-125087 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-125087"
},
{
"name": "Submit #1042415 | https://github.com/Michael-A-Kuykendall/ shimmy 2.6.4 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1042415"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Michael-A-Kuykendall/shimmy/issues/221"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Michael-A-Kuykendall/shimmy/commit/3f2ee748c02eeb229987913fe289a2ed9a24595d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Michael-A-Kuykendall/shimmy/releases/tag/v2.6.5"
},
{
"tags": [
"product"
],
"url": "https://github.com/Michael-A-Kuykendall/shimmy/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T18:25:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Michael-A-Kuykendall Shimmy Inference API server.rs missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-125087",
"datePublished": "2026-11-10T01:00:27.382Z",
"dateReserved": "2026-11-09T17:19:54.778Z",
"dateUpdated": "2026-11-10T01:00:27.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125076 (GCVE-0-2026-125076)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:30 – Updated: 2026-11-09 23:30 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Smart Attendance System with QR Code Scanner JSON Endpoint attendance_handler.php missing authentication
Summary
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Severity
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433180 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433180/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-125076 | third-party-advisory |
| https://vuldb.com/submit/1041014 | third-party-advisory |
| https://github.com/yuechuya/sourcecodester-vuln-r… | exploit |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Smart Attendance System with QR Code Scanner |
Affected:
1.0
cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"
],
"modules": [
"JSON Endpoint"
],
"product": "Smart Attendance System with QR Code Scanner",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yuechuya (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:30:24.227Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433180 | SourceCodester Smart Attendance System with QR Code Scanner JSON Endpoint attendance_handler.php missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433180"
},
{
"name": "VDB-433180 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433180/cti"
},
{
"name": "CVE-2026-125076 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-125076"
},
{
"name": "Submit #1041014 | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Missing Authentication for Critical Function",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1041014"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-03-Unauthenticated-Attendance-Write.md"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T18:01:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Smart Attendance System with QR Code Scanner JSON Endpoint attendance_handler.php missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-125076",
"datePublished": "2026-11-09T23:30:24.227Z",
"dateReserved": "2026-11-09T16:56:34.219Z",
"dateUpdated": "2026-11-09T23:30:24.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125075 (GCVE-0-2026-125075)
Vulnerability from cvelistv5 – Published: 2026-11-09 23:00 – Updated: 2026-11-09 23:00 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authentication
Summary
A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file create_admin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Severity
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433179 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433179/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-125075 | third-party-advisory |
| https://vuldb.com/submit/1041013 | third-party-advisory |
| https://github.com/yuechuya/sourcecodester-vuln-r… | exploit |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Smart Attendance System with QR Code Scanner |
Affected:
1.0
cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin Account Creation"
],
"product": "Smart Attendance System with QR Code Scanner",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yuechuya (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This impacts the function getMessage of the file create_admin.php of the component Admin Account Creation. Such manipulation of the argument e leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:00:27.918Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433179 | SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433179"
},
{
"name": "VDB-433179 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433179/cti"
},
{
"name": "CVE-2026-125075 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-125075"
},
{
"name": "Submit #1041013 | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Missing Authentication for Critical Function",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1041013"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-02-Unauthenticated-Admin-Creation.md"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T18:01:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-125075",
"datePublished": "2026-11-09T23:00:27.918Z",
"dateReserved": "2026-11-09T16:56:29.380Z",
"dateUpdated": "2026-11-09T23:00:27.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124578 (GCVE-0-2026-124578)
Vulnerability from cvelistv5 – Published: 2026-11-09 07:30 – Updated: 2026-11-09 22:37
VLAI
EPSS
VEX
Title
Pantum BP5100DW Web omDB.shtml missing authentication
Summary
A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:37 UTC
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432924 | vdb-entry |
| https://vuldb.com/vuln/432924/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124578 | third-party-advisory |
| https://vuldb.com/submit/1038185 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124578",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:37:02.678835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:37:14.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:pantum:bp5100dw:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Interface"
],
"product": "BP5100DW",
"vendor": "Pantum",
"versions": [
{
"status": "affected",
"version": "3.A.4.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JoasHS (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T07:30:16.490Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432924 | Pantum BP5100DW Web omDB.shtml missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/432924"
},
{
"name": "VDB-432924 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432924/cti"
},
{
"name": "CVE-2026-124578 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124578"
},
{
"name": "Submit #1038185 | Zhuhai Pantum Electronics BP5100DW printer Firmware 3.A.4.7 Unauthenticated disclosure of device configuration and credentials via /shtml/omDB.shtml",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1038185"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T18:12:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "Pantum BP5100DW Web omDB.shtml missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124578",
"datePublished": "2026-11-09T07:30:16.490Z",
"dateReserved": "2026-11-08T17:07:13.997Z",
"dateUpdated": "2026-11-09T22:37:14.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124577 (GCVE-0-2026-124577)
Vulnerability from cvelistv5 – Published: 2026-11-09 07:15 – Updated: 2026-11-09 07:15
VLAI
EPSS
VEX
Title
Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication
Summary
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised.
Severity
9.8 (Critical)
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432923 | vdb-entry |
| https://vuldb.com/vuln/432923/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124577 | third-party-advisory |
| https://vuldb.com/submit/1038184 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intelbras | SG 2404 PoE L2+ |
Affected:
1.00.70
Affected: 1.00.72 Unaffected: 1.00.74 cpe:2.3:h:intelbras:sg_2404_poe_l2_:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:intelbras:sg_2404_poe_l2_:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "SG 2404 PoE L2+",
"vendor": "Intelbras",
"versions": [
{
"status": "affected",
"version": "1.00.70"
},
{
"status": "affected",
"version": "1.00.72"
},
{
"status": "unaffected",
"version": "1.00.74"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JoasHS (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB Vulnerability Moderation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T07:15:16.393Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432923 | Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/432923"
},
{
"name": "VDB-432923 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432923/cti"
},
{
"name": "CVE-2026-124577 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124577"
},
{
"name": "Submit #1038184 | Intelbras SG 2404 PoE L2+ managed switch Firmware 1.00.70, 1.00.72 (hardware B1) Authentication bypass in web management interface allows unauthenticated execution of privileged CLI commands via /EXCU_SHELL",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1038184"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T18:07:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124577",
"datePublished": "2026-11-09T07:15:16.393Z",
"dateReserved": "2026-11-08T17:02:20.350Z",
"dateUpdated": "2026-11-09T07:15:16.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124573 (GCVE-0-2026-124573)
Vulnerability from cvelistv5 – Published: 2026-11-09 06:15 – Updated: 2026-11-09 06:15
VLAI
EPSS
VEX
Title
logseq Local HTTP API server.cljs validate-auth-token missing authentication
Summary
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432919 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432919/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124573 | third-party-advisory |
| https://vuldb.com/submit/1035945 | third-party-advisory |
| https://github.com/logseq/logseq/issues/13596 | exploitissue-tracking |
| https://github.com/logseq/logseq/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:logseq:logseq:*:*:*:*:*:*:*:*"
],
"modules": [
"Local HTTP API"
],
"product": "logseq",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "akamoli (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T06:15:15.285Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432919 | logseq Local HTTP API server.cljs validate-auth-token missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432919"
},
{
"name": "VDB-432919 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432919/cti"
},
{
"name": "CVE-2026-124573 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124573"
},
{
"name": "Submit #1035945 | https://github.com/logseq logseq 2.0.1 Local Sensitive Logic exposure lead to Command Execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035945"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/logseq/logseq/issues/13596"
},
{
"tags": [
"product"
],
"url": "https://github.com/logseq/logseq/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T17:56:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "logseq Local HTTP API server.cljs validate-auth-token missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124573",
"datePublished": "2026-11-09T06:15:15.285Z",
"dateReserved": "2026-11-08T16:51:31.805Z",
"dateUpdated": "2026-11-09T06:15:15.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123963 (GCVE-0-2026-123963)
Vulnerability from cvelistv5 – Published: 2026-11-07 12:30 – Updated: 2026-11-07 12:30
VLAI
EPSS
VEX
Title
OpenBMB Internet of Agents Agent Registry app.py register missing authentication
Summary
A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432033 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432033/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123963 | third-party-advisory |
| https://vuldb.com/submit/1033797 | third-party-advisory |
| https://github.com/OpenBMB/IoA/issues/21 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenBMB | Internet of Agents |
Affected:
9d78e88e47160eb42ee1ee8538c05e1c2c47877a
cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:*"
],
"modules": [
"Agent Registry"
],
"product": "Internet of Agents",
"vendor": "OpenBMB",
"versions": [
{
"status": "affected",
"version": "9d78e88e47160eb42ee1ee8538c05e1c2c47877a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Evo1ution (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T12:30:12.500Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432033 | OpenBMB Internet of Agents Agent Registry app.py register missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432033"
},
{
"name": "VDB-432033 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432033/cti"
},
{
"name": "CVE-2026-123963 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123963"
},
{
"name": "Submit #1033797 | OpenBMB Internet of Agents(IoA) 9d78e88 Improper Input Validation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033797"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/OpenBMB/IoA/issues/21"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-06T18:17:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenBMB Internet of Agents Agent Registry app.py register missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123963",
"datePublished": "2026-11-07T12:30:12.500Z",
"dateReserved": "2026-11-06T17:12:27.519Z",
"dateUpdated": "2026-11-07T12:30:12.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123816 (GCVE-0-2026-123816)
Vulnerability from cvelistv5 – Published: 2026-11-09 21:15 – Updated: 2026-11-09 21:15
VLAI
EPSS
VEX
Title
pyLoad: Authentication bypass in API key validation (check_apikey cache)
Summary
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the same key_id reaches the cache-hit path without comparing apikey[-43:] to the stored hash through hmac.compare_digest. Key identifiers are small sequential integers, so an unauthenticated remote attacker can enumerate an active identifier and inherit the cached key owner's permissions during the 300-second cache lifetime. This issue is fixed in version 0.5.0b3.dev101.
Severity
8.1 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
GitHub_M
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/pyload/pyload/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pyload/pyload/commit/00d137251… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "pyload",
"vendor": "pyload",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.0b3.dev101"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the same key_id reaches the cache-hit path without comparing apikey[-43:] to the stored hash through hmac.compare_digest. Key identifiers are small sequential integers, so an unauthenticated remote attacker can enumerate an active identifier and inherit the cached key owner\u0027s permissions during the 300-second cache lifetime. This issue is fixed in version 0.5.0b3.dev101."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:15:48.314Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-r44w-v6gf-x3p6"
},
{
"name": "https://github.com/pyload/pyload/commit/00d1372510f915f843b1574a3f1b28fbb724a42e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyload/pyload/commit/00d1372510f915f843b1574a3f1b28fbb724a42e"
}
],
"source": {
"advisory": "GHSA-r44w-v6gf-x3p6",
"discovery": "UNKNOWN"
},
"title": "pyLoad: Authentication bypass in API key validation (check_apikey cache)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123816",
"datePublished": "2026-11-09T21:15:48.314Z",
"dateReserved": "2026-11-06T15:27:56.227Z",
"dateUpdated": "2026-11-09T21:15:48.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123802 (GCVE-0-2026-123802)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:23 – Updated: 2026-11-09 18:23
VLAI
EPSS
VEX
Title
SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user
Summary
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
8.1 (High)
CWE
Assigner
GitHub_M
CNA
References
18 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 11.3.0, < 11.3.8
Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker\u0027s own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target\u0027s audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:23:40.216Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-wfg2-vqfg-rqh6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-wfg2-vqfg-rqh6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-wfg2-vqfg-rqh6",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core SAML: identity taken from an assertion that never passed the audience check, allowing sign-in as any IdP user"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123802",
"datePublished": "2026-11-09T18:23:40.216Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T18:23:40.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123798 (GCVE-0-2026-123798)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:04 – Updated: 2026-11-09 18:04
VLAI
EPSS
VEX
Title
SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user
Summary
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10.
Severity
8.1 (High)
Assigner
GitHub_M
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/supertokens/supertokens-core/s… | x_refsource_CONFIRM |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/c… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
| https://github.com/supertokens/supertokens-core/r… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 12.0.6, < 12.0.10
Affected: >= 11.4.0, < 11.4.7 Affected: >= 11.3.0, < 11.3.7 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 12.0.6, \u003c 12.0.10"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.7"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:04:20.419Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10"
}
],
"source": {
"advisory": "GHSA-gvx2-mwmj-wwvj",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: SAML XML Signature Wrapping authentication bypass \u2014 any IdP user can authenticate as any other user"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123798",
"datePublished": "2026-11-09T18:04:20.419Z",
"dateReserved": "2026-11-06T15:27:56.225Z",
"dateUpdated": "2026-11-09T18:04:20.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.