CVE-2026-102248

Rebuild Login Endpoint login improper authentication

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rebuild

Products

Rebuild

CVE-2026-101269

Incorrect session validation for API-uploaded files

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix

CVE-2026-93402

rsyslog: rsyslog: imdtls permitted-peer authorization bypass

A flaw was found in rsyslog. When using the imdtls input module configured for name or fingerprint authentication, permitted-peer identity checks are not enforced after a successful DTLS handshake. A remote attacker possessing a valid certificate signed by the listener's trusted Certificate Authority could bypass peer restrictions and inject unauthorized syslog records into the input stream.

CVSS 3.1 · 3.1 Low EPSS n/a KEV · Not listed

Vendors

Rsyslog

Products

Rsyslog

CVE-2026-77244

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials. A network client that can reach the MCP endpoint can invoke Atlassian tools as the operator, including read and write operations available to that account. The advisory traces the vulnerable input and processing flow through UserTokenMiddleware, AtlassianOpaqueTokenVerifier, _get_fetcher, and streamable-http, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Mcp-atlassian Sooperset

Products

Mcp Atlassian Mcp-atlassian

CVE-2026-85350

UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Upsellwp

CVE-2026-97231

volotat Anagnorisis Socket.IO Connect app.py missing authentication

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Volotat

Products

Anagnorisis

CVE-2026-56737

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Thorsten

Products

Phpmyfaq

CVE-2026-82843

WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Oauth Server

CVE-2026-100606

Flowise through 3.1.4 Authentication Bypass via SSO Email Match

Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user record from the database — including the server-stored single-use invitation tempToken — into the data passed to AccountService.register(). The register handler's token lookup, email match, and expiry checks therefore pass trivially against the server's own token instead of a caller-supplied one, and the account and its organization membership are flipped to ACTIVE. As a result, anyone able to authenticate at any configured SSO provider using a pending invitee's email address as the email claim can take over that invitation and obtain the invited user's access to the organization without ever possessing the emailed invitation token, for as long as the invitation is valid (24 hours by default). At the time of the advisory no patched version was available.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Flowiseai

Products

Flowise

CVE-2026-57178

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Python-social-auth

Products

Social-core

CVE-2026-100607

Flowise through 3.1.4 Authentication Bypass via Email-Only SSO

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Flowiseai

Products

Flowise

CVE-2026-100684

Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the IdP-asserted email address alone — without validating an invite code and without an email_verified check (the email_verified gate protects only the existing-account lookup). An attacker who can register at an IdP that the tenant trusts for OIDC and assert a victim's invited email address (even with email_verified=false) claims the pending invite and inherits all of its granted privileges, including builder and admin.global, with no admin exclusion. This results in takeover of the invited principal and, for admin invites, full tenant compromise (access to all apps, datasources including production credentials, and automations); the invite is consumed, denying onboarding to the legitimate invitee.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Budibase

Products

Server

CVE-2026-101077

Netcore NR289-GE boa_temp process_request missing authentication

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Netcore

Products

Nr289-ge

CVE-2026-85056

ZITADEL: MFA bypass via session reuse in Login V2

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Zitadel

Products

Zitadel

CVE-2026-101049

Heym before 0.0.53 Slack Webhook Signature Verification Bypass

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Heymrun

Products

Heym

CVE-2026-97879

zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zhistaredu

Products

Startraining

CVE-2026-52749

Improper Authentication in Kaon AR2140X

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities. These actions can be abused to force the router to issue GET requests to arbitrarily chosen domains. This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kaon

Products

Ar2140

CVE-2026-101050

Heym before 0.0.53 Authentication Bypass via Telegram Webhook

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Heymrun

Products

Heym

CVE-2026-100746

coollabsio Coolify GitHub App Setup redirect missing authentication

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Coollabsio

Products

Coolify

CVE-2026-76711

Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Analytics And Location Engine Ale