Common Weakness Enumeration
CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
6982 vulnerabilities reference this CWE, most recent first.
CVE-2026-110653 (GCVE-0-2026-110653)
Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-17 02:31
VLAI
EPSS
VEX
Title
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Summary
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts < 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers — who know a target customer's registered email address or phone number — to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race.
Severity
9.1 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| latepoint | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress |
Affected:
0 , ≤ 5.7.4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress",
"vendor": "latepoint",
"versions": [
{
"lessThanOrEqual": "5.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ekene Umegakwe"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Appointment Booking Plugin \u2013 LatePoint | Calendar \u0026 Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP` function: the counter is incremented using a stale in-memory value with no conditional `WHERE attempts \u003c 10` guard on the `UPDATE` and no `SELECT ... FOR UPDATE` row lock, creating a TOCTOU window that allows concurrent requests to bypass the 10-attempt lockout. This makes it possible for unauthenticated attackers \u2014 who know a target customer\u0027s registered email address or phone number \u2014 to fire concurrent requests to the `auth__verify_otp` endpoint, defeat the lockout cap, brute-force the 6-digit OTP code, and authenticate as the targeted LatePoint customer, gaining full access to their account, bookings, and personal data. The nonce check present on the endpoint (`otp_verify_otp_nonce`) does not mitigate this issue, as the nonce is publicly emitted by the unauthenticated `request_otp` and `resend_otp` endpoints and is trivially obtainable by any unauthenticated attacker prior to launching the race."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T02:31:06.697Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L228"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L185"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L30"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/controllers/auth_controller.php#L14"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/models/model.php#L773"
},
{
"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.5/lib/helpers/otp_helper.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T13:23:22.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-16T14:24:52.000Z",
"value": "Disclosed"
}
],
"title": "Appointment Booking Plugin \u003c= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110653",
"datePublished": "2026-10-17T02:31:06.697Z",
"dateReserved": "2026-10-14T13:08:07.307Z",
"dateUpdated": "2026-10-17T02:31:06.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110097 (GCVE-0-2026-110097)
Vulnerability from cvelistv5 – Published: 2026-10-13 16:53 – Updated: 2026-10-14 15:42
VLAI
EPSS
VEX
Title
Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
Summary
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 15:39 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ikaros-… | third-party-advisory |
| https://github.com/ikaros-dev/ikaros/blob/v1.2.5/… | technical-description |
| https://github.com/ikaros-dev/ikaros/blob/v1.2.5/… | technical-description |
| https://github.com/ikaros-dev/ikaros/blob/v1.2.5/… | technical-description |
| https://github.com/ikaros-dev/ikaros/releases/tag… | release-notes |
| https://www.vulncheck.com/advisories/ikaros-1.2.0… | third-party-advisory |
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-202… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ikaros-dev | ikaros |
Affected:
1.2.0 , ≤ 1.2.5
(semver)
|
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110097",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T15:39:50.462426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:42:16.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110097-ikaros-2fa-bypass-temp-token"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ikaros",
"repo": "https://github.com/ikaros-dev/ikaros",
"vendor": "ikaros-dev",
"versions": [
{
"lessThanOrEqual": "1.2.5",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:53:02.487Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ikaros-2fa-bypass-temp-token"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authentication/jwt/JwtAuthenticationProvider.java#L57-L112"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/authentication/jwt/JwtAuthenticationFilter.java#L30-L46"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ikaros-dev/ikaros/blob/v1.2.5/server/src/main/java/run/ikaros/server/security/SecurityEndpoint.java#L80-L118"
},
{
"name": "v1.2.5 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/ikaros-dev/ikaros/releases/tag/v1.2.5"
},
{
"name": "VulnCheck Advisory: Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ikaros-1.2.0-through-1.2.5-totp-authentication-bypass-via-temp-token"
}
],
"title": "Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110097",
"datePublished": "2026-10-13T16:53:02.487Z",
"dateReserved": "2026-10-13T16:22:00.915Z",
"dateUpdated": "2026-10-14T15:42:16.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109506 (GCVE-0-2026-109506)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:31 – Updated: 2026-10-15 19:33
VLAI
EPSS
VEX
Title
Improper Authentication in Multiple TP-Link WiFi Repeaters
Summary
Multiple
TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary
transformation in the HTTP web-management login flow. An unauthenticated attacker
on the same local network who can capture the network traffic associated with
legitimate administrator login may be able to derive an alternative credential
value that produces the same accepted authentication result and use it to
authenticate to the device’s web-management interface with administrator
privileges. Exploitation requires the management login to use HTTP and the
attacker to observe the session key, dictionary, and login value associated
with a legitimate administrator login.
Successful
exploitation may allow an unauthenticated adjacent attacker to gain
administrator access to the affected device and modify exposed configuration
settings.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:33 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.tp-link.com/us/support/download/ | patch |
| https://www.tp-link.com/en/support/download/ | patch |
| https://www.tp-link.com/us/support/faq/5344/ | vendor-advisory |
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link Systems Inc. | RE190 v5 |
Affected:
0 , < V5_260904
(custom)
|
|
| TP-Link Systems Inc. | RE200 v5 |
Affected:
0 , < V5_260904
(custom)
|
|
| TP-Link Systems Inc. | RE205 v4 |
Affected:
0 , < V4_260904
(custom)
|
|
| TP-Link Systems Inc. | RE215 v1 |
Affected:
0 , < V1_260904
(custom)
|
|
| TP-Link Systems Inc. | RE220 v3 |
Affected:
0 , < V3_260904
(custom)
|
|
| TP-Link Systems Inc. | RE230 v2 |
Affected:
0 , < V2_260904
(custom)
|
|
| TP-Link Systems Inc. | RE300 v2 |
Affected:
0 , < V2_260904
(custom)
|
|
| TP-Link Systems Inc. | RE305 v4 |
Affected:
0 , < V4_260904
(custom)
|
|
| TP-Link Systems Inc. | RE330 v1 |
Affected:
0 , < V1_260904
(custom)
|
|
| TP-Link Systems Inc. | RE335 v1 |
Affected:
0 , < V1_260904
(custom)
|
|
| TP-Link Systems Inc. | RE365 v2 |
Affected:
0 , < V2_260904
(custom)
|
|
| TP-Link Systems Inc. | RE365 v3 |
Affected:
0 , < V3_260904
(custom)
|
|
| TP-Link Systems Inc. | RE750C v4 |
Affected:
0 , < V4_260904
(custom)
|
|
| TP-Link Systems Inc. | RE450 v4.8 |
Affected:
0 , < V4_260915
(custom)
|
|
| TP-Link Systems Inc. | RE550 v1 |
Affected:
0 , < V1_260915
(custom)
|
|
| TP-Link Systems Inc. | RE315 v1 |
Affected:
0 , < V1_260904 rel3959
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109506",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:33:36.294343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:33:44.764Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RE190 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V5_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE200 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V5_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE205 v4",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V4_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE215 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE220 v3",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V3_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE230 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V2_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE300 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V2_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE305 v4",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V4_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE330 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE335 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE365 v2",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V2_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE365 v3",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V3_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE750C v4",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V4_260904",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE450 v4.8",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V4_260915",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE550 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_260915",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RE315 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_260904 rel3959",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lukas Palm"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMultiple\nTP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary\ntransformation in the HTTP web-management login flow. An unauthenticated attacker\non the same local network who can capture the network traffic associated with\nlegitimate administrator login may be able to derive an alternative credential\nvalue that produces the same accepted authentication result and use it to\nauthenticate to the device\u2019s web-management interface with administrator\nprivileges. Exploitation requires the management login to use HTTP and the\nattacker to observe the session key, dictionary, and login value associated\nwith a legitimate administrator login.\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may allow an unauthenticated adjacent attacker to gain\nadministrator access to the affected device and modify exposed configuration\nsettings.\u003c/p\u003e"
}
],
"value": "Multiple\nTP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary\ntransformation in the HTTP web-management login flow. An unauthenticated attacker\non the same local network who can capture the network traffic associated with\nlegitimate administrator login may be able to derive an alternative credential\nvalue that produces the same accepted authentication result and use it to\nauthenticate to the device\u2019s web-management interface with administrator\nprivileges. Exploitation requires the management login to use HTTP and the\nattacker to observe the session key, dictionary, and login value associated\nwith a legitimate administrator login.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent attacker to gain\nadministrator access to the affected device and modify exposed configuration\nsettings."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:31:37.228Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5344/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper Authentication in Multiple TP-Link WiFi Repeaters",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-109506",
"datePublished": "2026-10-14T18:31:37.228Z",
"dateReserved": "2026-10-12T17:19:32.357Z",
"dateUpdated": "2026-10-15T19:33:44.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109372 (GCVE-0-2026-109372)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:05 – Updated: 2026-10-13 16:23
VLAI
EPSS
VEX
Title
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Summary
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:22 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/zitadel/zitadel/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/zitadel-3.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:22:19.279311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:23:38.085Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zitadel",
"vendor": "zitadel",
"versions": [
{
"lessThan": "4.19.2",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.2",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "livio-a"
},
{
"lang": "en",
"type": "finder",
"value": "IAM-marco"
},
{
"lang": "en",
"type": "reporter",
"value": "everping"
},
{
"lang": "en",
"type": "reporter",
"value": "AdamKorcz"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:05:44.977Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x4c7-fpcx-w9q6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-x4c7-fpcx-w9q6"
},
{
"name": "VulnCheck Advisory: ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-account-takeover-via-saml-identity-provider-confusion"
}
],
"title": "ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109372",
"datePublished": "2026-10-12T16:05:44.977Z",
"dateReserved": "2026-10-12T14:23:25.691Z",
"dateUpdated": "2026-10-13T16:23:38.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109313 (GCVE-0-2026-109313)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:05 – Updated: 2026-10-13 15:47
VLAI
EPSS
VEX
Title
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Summary
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:47 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisorythird-party-advisory |
| https://www.vulncheck.com/advisories/grav-login-p… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getgrav | grav-plugin-login |
Affected:
2.7.0 , < 3.9.9
(semver)
Unaffected: 3.9.9 (semver) |
Date Public
2026-09-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109313",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:47:41.234513Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:47:59.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "grav-plugin-login",
"repo": "https://github.com/getgrav/grav-plugin-login",
"vendor": "getgrav",
"versions": [
{
"lessThan": "3.9.9",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.9.9",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "redwolf1919"
}
],
"datePublic": "2026-09-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:05:08.299Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cmg5-qw8p-gxcf)",
"tags": [
"vendor-advisory",
"third-party-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-cmg5-qw8p-gxcf"
},
{
"name": "VulnCheck Advisory: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-login-plugin-2.7.0-before-3.9.9-2fa-bypass-via-remember-me-cookie"
}
],
"title": "Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109313",
"datePublished": "2026-10-12T16:05:08.299Z",
"dateReserved": "2026-10-12T14:14:27.021Z",
"dateUpdated": "2026-10-13T15:47:59.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109312 (GCVE-0-2026-109312)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:05 – Updated: 2026-10-15 02:43
VLAI
EPSS
VEX
Title
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
Summary
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 02:43 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisorythird-party-advisory |
| https://www.vulncheck.com/advisories/grav-login-p… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getgrav | grav-plugin-login |
Affected:
2.7.0 , < 3.9.9
(semver)
Unaffected: 3.9.9 (semver) |
Date Public
2026-09-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109312",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T02:43:33.274508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T02:43:42.835Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "grav-plugin-login",
"repo": "https://github.com/getgrav/grav-plugin-login",
"vendor": "getgrav",
"versions": [
{
"lessThan": "3.9.9",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.9.9",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "redwolf1919"
}
],
"datePublic": "2026-09-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim\u0027s password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:05:07.605Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5rph-jqcf-2x36)",
"tags": [
"vendor-advisory",
"third-party-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-5rph-jqcf-2x36"
},
{
"name": "VulnCheck Advisory: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-login-plugin-2.7.0-before-3.9.9-2fa-bypass-via-profile-update-form"
}
],
"title": "Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109312",
"datePublished": "2026-10-12T16:05:07.605Z",
"dateReserved": "2026-10-12T14:14:27.021Z",
"dateUpdated": "2026-10-15T02:43:42.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109114 (GCVE-0-2026-109114)
Vulnerability from cvelistv5 – Published: 2026-10-13 08:15 – Updated: 2026-10-13 13:16
VLAI
EPSS
VEX
Title
AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication
Summary
A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:15 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416871 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416871/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109114 | third-party-advisory |
| https://vuldb.com/submit/955105 | third-party-advisory |
| https://github.com/AdithyaYelloju/Restaurant-Mana… | exploitissue-tracking |
| https://github.com/AdithyaYelloju/Restaurant-Mana… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AdithyaYelloju | Restaurant-Management-System |
Affected:
7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c
cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109114",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:15:54.777022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:16:14.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Login Form"
],
"product": "Restaurant-Management-System",
"vendor": "AdithyaYelloju",
"versions": [
{
"status": "affected",
"version": "7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "100001001X (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T08:15:15.240Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416871 | AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416871"
},
{
"name": "VDB-416871 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416871/cti"
},
{
"name": "CVE-2026-109114 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109114"
},
{
"name": "Submit #955105 | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Authentication Bypass Using Alternate Channel",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/955105"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/11"
},
{
"tags": [
"product"
],
"url": "https://github.com/AdithyaYelloju/Restaurant-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T11:44:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109114",
"datePublished": "2026-10-13T08:15:15.240Z",
"dateReserved": "2026-10-12T09:39:15.001Z",
"dateUpdated": "2026-10-13T13:16:14.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109082 (GCVE-0-2026-109082)
Vulnerability from cvelistv5 – Published: 2026-10-12 06:18 – Updated: 2026-10-15 15:16
VLAI
EPSS
VEX
Title
Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients
Summary
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:11 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-109082 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2549478 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
Date Public
2026-10-09 18:42
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:11:52.777242Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:16:24.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "keycloak-services",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank MZOUGHI Mohamed Amine (zerOiQ) for reporting this issue."
}
],
"datePublic": "2026-10-09T18:42:43.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T07:12:27.872Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-109082"
},
{
"name": "RHBZ#2549478",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549478"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T18:42:43.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-09T18:42:43.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-287: Improper Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-109082",
"datePublished": "2026-10-12T06:18:08.096Z",
"dateReserved": "2026-10-12T06:09:06.647Z",
"dateUpdated": "2026-10-15T15:16:24.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108972 (GCVE-0-2026-108972)
Vulnerability from cvelistv5 – Published: 2026-10-13 06:00 – Updated: 2026-10-15 15:13 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication
Summary
A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:52 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416791 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416791/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108972 | third-party-advisory |
| https://vuldb.com/submit/1000486 | third-party-advisory |
| https://tracexlabs.com/releases/hrm-10-preauth-ad… | exploitpatch |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Human Resource Management System |
Affected:
1.0
cpe:2.3:a:sourcecodester:human_resource_management_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108972",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:52:21.478408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:13:14.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:human_resource_management_system:*:*:*:*:*:*:*:*"
],
"modules": [
"Employee Endpoint"
],
"product": "Human Resource Management System",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "SanthoshKumar (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T06:00:15.758Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416791 | SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416791"
},
{
"name": "VDB-416791 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416791/cti"
},
{
"name": "CVE-2026-108972 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108972"
},
{
"name": "Submit #1000486 | SourceCodester Human Resource Management System 10 No Auth Check on the Employee Endpoint: Anyone Creates an Admin,",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1000486"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://tracexlabs.com/releases/hrm-10-preauth-admin-takeover.html"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T22:02:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108972",
"datePublished": "2026-10-13T06:00:15.758Z",
"dateReserved": "2026-10-11T19:56:58.531Z",
"dateUpdated": "2026-10-15T15:13:14.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108921 (GCVE-0-2026-108921)
Vulnerability from cvelistv5 – Published: 2026-10-12 18:45 – Updated: 2026-10-13 16:02
VLAI
EPSS
VEX
Title
KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication
Summary
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:02 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416734 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416734/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108921 | third-party-advisory |
| https://vuldb.com/submit/994370 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| KusalkaSilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108921",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:02:05.338476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:02:16.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"State-Changing Endpoints"
],
"product": "Learning-Management-System",
"vendor": "KusalkaSilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "vuldb2026 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T18:45:15.546Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416734 | KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416734"
},
{
"name": "VDB-416734 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416734/cti"
},
{
"name": "CVE-2026-108921 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108921"
},
{
"name": "Submit #994370 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/994370"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T19:35:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108921",
"datePublished": "2026-10-12T18:45:15.546Z",
"dateReserved": "2026-10-11T17:30:13.900Z",
"dateUpdated": "2026-10-13T16:02:16.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.