Common Weakness Enumeration

CWE-288

Allowed

Authentication Bypass Using an Alternate Path or Channel

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

661 vulnerabilities reference this CWE, most recent first.

CVE-2026-123797 (GCVE-0-2026-123797)

Vulnerability from cvelistv5 – Published: 2026-11-09 17:52 – Updated: 2026-11-09 17:59
VLAI
Title
SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement
Summary
SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
supertokens supertokens-core Affected: < 11.3.6
Affected: >= 11.4.0, < 11.4.6
Affected: >= 12.0.6, < 12.0.8
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "supertokens-core",
          "vendor": "supertokens",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.3.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.4.0, \u003c 11.4.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 12.0.6, \u003c 12.0.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/io/supertokens/webserver/WebserverAPI.java, checkIPAccess and assertThatAPIKeyCheckPasses suppress TenantOrAppNotFoundException, while the later app-specific handler resolves app/public storage and the public-tenant guard applies only to CDI versions 5.0 and later. An unauthenticated caller able to reach the Core endpoint can therefore use PUT /ghosttenant/recipe/role and GET /ghosttenant/recipe/roles to create and enumerate application roles without a valid API key. This issue is fixed in versions 11.3.6, 11.4.6, and 12.0.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T17:59:25.028Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-q7mc-f2jm-r4gr"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/1bad648d7b77aca058cb6bf75373455bacc4e537"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/5811a10190b1d4d8d7a9fe2e17cb49437e6ffa49"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/commit/7ce22db2b6ba95d7666adc51bb9ee60ac7d3d198"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.6"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.6"
        },
        {
          "name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.8"
        }
      ],
      "source": {
        "advisory": "GHSA-q7mc-f2jm-r4gr",
        "discovery": "UNKNOWN"
      },
      "title": "SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-123797",
    "datePublished": "2026-11-09T17:52:54.576Z",
    "dateReserved": "2026-11-06T15:27:56.225Z",
    "dateUpdated": "2026-11-09T17:59:25.028Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123746 (GCVE-0-2026-123746)

Vulnerability from cvelistv5 – Published: 2026-11-06 12:36 – Updated: 2026-11-06 12:36
VLAI
Title
Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
Summary
The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. AuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle’s Security::login() to authenticate a user programmatically, but it does not dispatch the security.authentication.success event, on which checkPostAuth() runs. The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth() is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically. Applications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link. A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected. The fix makes AuthenticatorManager::authenticateUser() dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-288 - Authentication bypass using an alternate path or channel
Assigner
Checkmarx CNA
References
Impacted products
Vendor Product Version
sensiolabs symfony Affected: 0 , < 5.4.56 (git)
Affected: 6.0.0 , < 6.4.50 (git)
Affected: 7.0.0 , < 7.4.23 (git)
Affected: 8.0.0 , < 8.1.11 (git)
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
    cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Nicolas Grekas Vincent Cassiau from CyberVanguard
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/security-http",
          "defaultStatus": "unaffected",
          "modules": [
            "Symfony\\Component\\Security\\Http\\Authentication\\AuthenticatorManager"
          ],
          "packageName": "symfony/security-http",
          "product": "symfony",
          "repo": "https://github.com/symfony/security-http",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "5.4.56",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "lessThan": "6.4.50",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "7.4.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.56",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.50",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.23",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.1.11",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Vincent Cassiau from CyberVanguard"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eThe Symfony Security HTTP component\u0026nbsp;\u003c/span\u003e\u003ccode\u003eAuthenticatorManager::authenticateUser()\u003c/code\u003e\u003cspan\u003e does not run the firewall user checker\u2019s \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in\u003c/span\u003e\u0026nbsp;Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/p\u003e\u003cp\u003e\u003ccode\u003eAuthenticatorManager::authenticateUser()\u003c/code\u003e is used by \u003ccode\u003eUserAuthenticatorInterface::authenticateUser()\u003c/code\u003e and by the SecurityBundle\u2019s \u003ccode\u003eSecurity::login()\u003c/code\u003e to authenticate a user programmatically, but it\u0026nbsp;does not dispatch the \u003ccode\u003esecurity.authentication.success\u003c/code\u003e event, on which \u003ccode\u003echeckPostAuth()\u003c/code\u003e runs.\u0026nbsp;\u003cspan\u003eThe fix for CVE-2024-50341 made \u003c/span\u003e\u003ccode\u003eSecurity::login()\u003c/code\u003e\u003cspan\u003e call \u003c/span\u003e\u003ccode\u003echeckPreAuth()\u003c/code\u003e\u003cspan\u003e, but \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e was still skipped. As a result, an account rejected by a custom user checker in \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e\u0026nbsp;is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eApplications are affected when they use a custom user checker that rejects users in \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e and authenticate users programmatically, for example after a password reset or an e-mail verification link.\u0026nbsp;\u003c/span\u003eA user whose account is rejected can then obtain an authenticated session through that flow\u003cspan\u003e. The default user checker does nothing in \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e, so the default configuration is not affected.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThe fix makes\u0026nbsp;\u003ccode\u003eAuthenticatorManager::authenticateUser()\u003c/code\u003e\u0026nbsp;dispatch the \u003ccode\u003esecurity.authentication.success\u003c/code\u003e event once the token is created and before it is stored, as authentications through the firewall do, so that \u003ccode\u003echeckPostAuth()\u003c/code\u003e runs and can reject the user.\u003c/p\u003e"
            }
          ],
          "value": "The Symfony Security HTTP component\u00a0AuthenticatorManager::authenticateUser() does not run the firewall user checker\u2019s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in\u00a0Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nAuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle\u2019s Security::login() to authenticate a user programmatically, but it\u00a0does not dispatch the security.authentication.success event, on which checkPostAuth() runs.\u00a0The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth()\u00a0is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically.\n\n\n\nApplications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link.\u00a0A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected.\n\n\n\nThe fix makes\u00a0AuthenticatorManager::authenticateUser()\u00a0dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication bypass using an alternate path or channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T12:36:50.994Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-8f57-m8wj-x65w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/af0aae5012beedf0a0c3fd581fd8b9ef696240c4"
        }
      ],
      "source": {
        "advisory": "GHSA-8f57-m8wj-x65w",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-123746",
    "datePublished": "2026-11-06T12:36:50.994Z",
    "dateReserved": "2026-11-06T12:28:14.998Z",
    "dateUpdated": "2026-11-06T12:36:50.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123618 (GCVE-0-2026-123618)

Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-06 15:00
VLAI
Title
ABP Framework before 10.7.1 Authentication Bypass via External Login Provider
Summary
ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant.
Severity
7.6 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
abpframework abp Affected: 0 , < 10.7.1 (semver)
Create a notification for this product.
Date Public
2026-10-20 00:00
Credits
Nguyen Le Thanh Nam (yuwkaa) maliming
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:nuget/Volo.Abp.OpenIddict.AspNetCore",
          "product": "abp",
          "vendor": "abpframework",
          "versions": [
            {
              "lessThan": "10.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nguyen Le Thanh Nam (yuwkaa)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "maliming"
        }
      ],
      "datePublic": "2026-10-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T15:00:54.268Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request #26305",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/abpframework/abp/pull/26305"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/abpframework/abp/commit/59b04c48dddbf79c58a65808400b4ed11f902ef1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/abpframework/abp"
        },
        {
          "name": "Fix commit b2fd3cf",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/abpframework/abp/commit/b2fd3cf049c69e585fb621049fde55349865d132"
        },
        {
          "name": "abp 10.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/abpframework/abp/releases/tag/10.7.1"
        },
        {
          "name": "Password grant external-provider branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/abpframework/abp/blob/10.7.0/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs#L52-L77"
        },
        {
          "name": "VulnCheck Advisory: ABP Framework before 10.7.1 Authentication Bypass via External Login Provider",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/abp-framework-before-10.7.1-authentication-bypass-via-external-login-provider"
        }
      ],
      "title": "ABP Framework before 10.7.1 Authentication Bypass via External Login Provider",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123618",
    "datePublished": "2026-11-06T15:00:54.268Z",
    "dateReserved": "2026-11-06T01:04:42.201Z",
    "dateUpdated": "2026-11-06T15:00:54.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119498 (GCVE-0-2026-119498)

Vulnerability from cvelistv5 – Published: 2026-11-07 11:59 – Updated: 2026-11-07 18:26 X_Open Source
VLAI
Title
WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.4.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 18:11 UTC
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
Impacted products
Vendor Product Version
RelyWP Simple Cloudflare Turnstile Affected: 0 , ≤ 1.44.4 (custom)
Create a notification for this product.
Date Public
2026-11-07 17:15
Credits
Mateusz Będziński | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119498",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:11:00.434985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:26:30.510Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "simple-cloudflare-turnstile",
          "product": "Simple Cloudflare Turnstile",
          "vendor": "RelyWP",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.44.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.44.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mateusz B\u0119dzi\u0144ski | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-07T17:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.\u003cp\u003eThis issue affects Simple Cloudflare Turnstile: from n/a through 1.44.4.\u003c/p\u003e"
            }
          ],
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "Authentication Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T17:15:15.697Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/simple-cloudflare-turnstile/vulnerability/wordpress-simple-cloudflare-turnstile-plugin-1-44-4-broken-authentication-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Simple Cloudflare Turnstile plugin to the latest available version (at least 1.44.5)."
            }
          ],
          "value": "Update the WordPress Simple Cloudflare Turnstile plugin to the latest available version (at least 1.44.5)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Simple Cloudflare Turnstile plugin \u003c= 1.44.4 - Broken Authentication vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-119498",
    "datePublished": "2026-11-07T11:59:49.573Z",
    "dateReserved": "2026-10-30T09:20:18.655Z",
    "dateUpdated": "2026-11-07T18:26:30.510Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119420 (GCVE-0-2026-119420)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-11-05 21:14
VLAI
Title
Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
Summary
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:14 UTC
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
getlago lago Affected: 0 , ≤ 1.55.0 (semver)
Create a notification for this product.
Date Public
2026-08-13 00:00
Credits
Abraxas Labs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119420",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T21:14:22.634773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T21:14:44.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://abraxaslabs.tech/research/lago-invite-ato"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "lago",
          "repo": "https://github.com/getlago/lago-api",
          "vendor": "getlago",
          "versions": [
            {
              "lessThanOrEqual": "1.55.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim\u0027s email, accept with an arbitrary password, and receive a JWT to access the victim\u0027s organizations, billing data, API keys and payment integrations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:51.565Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/getlago/lago-api/pull/6146"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L15-L16"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/lago-invite-ato"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/getlago/lago-api"
        },
        {
          "name": "VulnCheck Advisory: Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lago-through-1.55.0-authentication-bypass-via-acceptinvite-graphql-mutation"
        }
      ],
      "title": "Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119420",
    "datePublished": "2026-10-30T11:30:51.565Z",
    "dateReserved": "2026-10-30T02:41:12.203Z",
    "dateUpdated": "2026-11-05T21:14:44.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118681 (GCVE-0-2026-118681)

Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-11-03 13:22
VLAI
Title
go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware
Summary
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 13:21 UTC
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
go-chi chi Affected: 0 , < 5.5.0 (semver)
Unaffected: 5.5.0 (semver)
Create a notification for this product.
Date Public
2026-10-14 00:00
Credits
dpfkdlemtp
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118681",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T13:21:58.146303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T13:22:44.537Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/go-chi/chi/v5",
          "product": "chi",
          "vendor": "go-chi",
          "versions": [
            {
              "lessThan": "5.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "dpfkdlemtp"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router\u0027s parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T18:59:52.523Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rqrp-8cg2-5958)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958"
        },
        {
          "name": "VulnCheck Advisory: go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/go-chi-chi-before-5.5.0-authentication-bypass-via-supressnotfound-middleware"
        }
      ],
      "title": "go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-118681",
    "datePublished": "2026-10-28T18:59:52.523Z",
    "dateReserved": "2026-10-28T17:28:46.441Z",
    "dateUpdated": "2026-11-03T13:22:44.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118582 (GCVE-0-2026-118582)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:08 – Updated: 2026-11-06 13:46
VLAI
Title
CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 13:46 UTC
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
drupal CNA
References
Impacted products
Vendor Product Version
Drupal CAPTCHA Affected: 0.0.0 , < 1.18.0 (semver)
Affected: 2.0.0 , < 2.0.11 (semver)
Create a notification for this product.
Date Public
2026-10-28 17:27
Credits
James Gilliland (neclimdul) Rodrigo Cabo (rodrigo-cabo) Jakob P (japerry) James Gilliland (neclimdul) Rob Loach (robloach) Swan Kalata (akalata) Bram Driesen (bramdriesen) Damien McKenna (damienmckenna) Michael Hess (mlhess) Juraj Nemec (poker10) Pierre Rudloff (prudloff) Stella Power (stella) Jess (xjm)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T13:46:36.586306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T13:46:40.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/captcha",
          "product": "CAPTCHA",
          "repo": "https://git.drupalcode.org/project/captcha",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.11",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Rodrigo Cabo (rodrigo-cabo)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakob P (japerry)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Rob Loach (robloach)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Bram Driesen (bramdriesen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Michael Hess (mlhess)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Stella Power (stella)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T17:27:47.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:46.618Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-281"
        }
      ],
      "title": "CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118582",
    "datePublished": "2026-10-30T03:08:46.618Z",
    "dateReserved": "2026-10-28T16:08:24.142Z",
    "dateUpdated": "2026-11-06T13:46:40.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118572 (GCVE-0-2026-118572)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:08 – Updated: 2026-11-06 12:41
VLAI
Title
OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 12:39 UTC
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
drupal CNA
References
Impacted products
Vendor Product Version
Drupal OAuth Login - OAuth OIDC SSO Affected: 0.0.0 , < 3.1.1 (semver)
Create a notification for this product.
Date Public
2026-10-28 17:35
Credits
Sanjeev Kumar (ksanjeev284) Akash khairnar (khairnarakash) Neetu Choudhary (neetu01) purva_shende Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118572",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T12:39:14.531882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T12:41:54.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/oauth_login_oauth2",
          "product": "OAuth Login - OAuth OIDC SSO",
          "repo": "https://git.drupalcode.org/project/oauth_login_oauth2",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.1.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjeev Kumar (ksanjeev284)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Akash khairnar (khairnarakash)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Neetu Choudhary (neetu01)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "purva_shende"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T17:35:17.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:41.455Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-284"
        }
      ],
      "title": "OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118572",
    "datePublished": "2026-10-30T03:08:41.455Z",
    "dateReserved": "2026-10-28T15:50:46.720Z",
    "dateUpdated": "2026-11-06T12:41:54.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118554 (GCVE-0-2026-118554)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:08 – Updated: 2026-11-06 12:25
VLAI
Title
OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 12:25 UTC
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
drupal CNA
References
Impacted products
Vendor Product Version
Drupal OpenID Connect Client Affected: 0.0.0 , < 2.3.1 (semver)
Create a notification for this product.
Date Public
2026-10-28 17:37
Credits
Sanjeev Kumar (ksanjeev284) Matthijs Van Assche (matthijs) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118554",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T12:25:18.180605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T12:25:58.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/oidc",
          "product": "OpenID Connect Client",
          "repo": "https://git.drupalcode.org/project/oidc",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.3.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjeev Kumar (ksanjeev284)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matthijs Van Assche (matthijs)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-10-28T17:37:54.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:38.343Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-287"
        }
      ],
      "title": "OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118554",
    "datePublished": "2026-10-30T03:08:38.343Z",
    "dateReserved": "2026-10-28T15:50:46.718Z",
    "dateUpdated": "2026-11-06T12:25:58.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116606 (GCVE-0-2026-116606)

Vulnerability from cvelistv5 – Published: 2026-11-02 12:59 – Updated: 2026-11-03 04:55
VLAI
Title
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
Summary
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 00:00 UTC
CWE
  • CWE-288 - Authentication bypass using an alternate path or channel
Assigner
Mandiant CNA
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T04:55:19.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Barracuda Email Security Gateway (ESG)",
          "vendor": "Barracuda Networks",
          "versions": [
            {
              "lessThan": "9.4.0.030",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance\u2019s global configuration."
            }
          ],
          "value": "An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance\u2019s global configuration."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication bypass using an alternate path or channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T12:59:11.278Z",
        "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "shortName": "Mandiant"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
    "assignerShortName": "Mandiant",
    "cveId": "CVE-2026-116606",
    "datePublished": "2026-11-02T12:59:11.278Z",
    "dateReserved": "2026-10-26T16:04:54.772Z",
    "dateUpdated": "2026-11-03T04:55:19.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

CAPEC-127: Directory Indexing

An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list