Все уязвимости

Authentication bypass vulnerability

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specia

Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

Gitea second-factor bypass through OpenID identity linking

MOVEit Transfer Authentication bypass in LDAP sign-on

Improper Multi-Factor Authentication Validation Allows Authentication Bypass

Apache MINA SSHD: LDAP password authentication ineffective

Apache MINA SSHD: Repeated-publickey policy bypass on server

grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

devpi: Database contents leak

Authentication bypass between ZCC and client connector portal

phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie

TOTP enrollment hijack: password gate skipped due to unawaited promise

Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

Apache Kerby: Kerberos Pre-Authentication Bypass

Serendipity < 2.6.1 Authentication Bypass via Username Collision

Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communic

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Improper Access Control in Elfatek Elektronics' ANKA JPD-00028

Authentication Bypass in gaizhenbiao/ChuanhuChatGPT

Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP

Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation

Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer

An unsafe default authentication vulnerability exists in the Initial Setup Authentication functional

Authentication Bypass in composiohq/composio

Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through upda

LinkJoin through 882f196 mishandles token ownership in password reset.

A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0