Common Weakness Enumeration
CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
6392 vulnerabilities reference this CWE, most recent first.
CVE-2026-16656 (GCVE-0-2026-16656)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:55 – Updated: 2026-08-20 18:28
VLAI
EPSS
VEX
Title
Vulnerabilities in IBM AIX and PowerVM VIOS
Summary
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 03:56 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7283858 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | AIX |
Affected:
7.2
Affected: 7.3 cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:* |
|
| IBM | PowerVM VIOS |
Affected:
4.1
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16656",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T03:56:58.463493Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:28:38.786Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*"
],
"product": "AIX",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "affected",
"version": "7.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*"
],
"product": "PowerVM VIOS",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CVE-2026-14970, CVE-2026-15061, CVE-2026-15078, CVE-2026-15065, CVE-2026-15068 were reported to IBM by Oneconsult AG (https://oneconsult.com/)."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.\u003c/p\u003e"
}
],
"value": "IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:55:53.967Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7283858"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eA.\u00a0 APARS\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIBM has assigned the following APARs to this problem:\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAIX Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAvailability\u00a0\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eSP\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eKEY\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.2.5\u003c/td\u003e\u003ctd\u003eIJ59566\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP13\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.2\u003c/td\u003e\u003ctd\u003eIJ59565\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP05\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.3\u003c/td\u003e\u003ctd\u003eIJ59564\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP03\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.4\u003c/td\u003e\u003ctd\u003eIJ59563\u00a0\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP02\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eVIOS Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAvailability\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eSP\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eKEY\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.0\u003c/td\u003e\u003ctd\u003eIJ59565\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.0.50\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.1\u003c/td\u003e\u003ctd\u003eIJ59564\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.1.30\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.2\u003c/td\u003e\u003ctd\u003eIJ59563\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.2.20\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eB.\u00a0 FIXES\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIBM strongly recommends addressing the vulnerability now.\u003c/p\u003e\u003cp\u003e\u00a0AIX and VIOS fixes are available and can be downloaded from Fix Central: \u003ca href=\"https://www.ibm.com/support/fixcentral\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u00a0An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.\u003c/p\u003e\u003cp\u003e\u00a0IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAIX Level\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eService Pack\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL04\u003c/td\u003e\u003ctd\u003eSP2\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL03\u003c/td\u003e\u003ctd\u003eSP3\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL02\u003c/td\u003e\u003ctd\u003eSP5\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.2 TL05\u00a0\u003c/td\u003e\u003ctd\u003eSP13\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003ePowerVM VIOS Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix Pack\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.2\u00a0\u003c/td\u003e\u003ctd\u003e4.1.2.20\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.1\u00a0\u003c/td\u003e\u003ctd\u003e4.1.1.30\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.0\u00a0\u00a0\u003c/td\u003e\u003ctd\u003e4.1.0.50\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7283157\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283157\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\u003c/p\u003e\u003cp\u003e\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.0.50 post-update instructions: \u003ca href=\"https://www.ibm.com/support/pages/node/7283819\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283819\u003c/a\u003e\u003cbr/\u003e\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.1.30 post-update instructions: \u003ca href=\"https://www.ibm.com/support/pages/node/7283823\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283823\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "A.\u00a0 APARS\n\n\n\nIBM has assigned the following APARs to this problem:\n\nAIX LevelAPARAvailability\u00a0\u00a0SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563\u00a008/14/2026SP02key_w_apar\n\n\n\n\n\nVIOS LevelAPARAvailability\u00a0SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar\n\n\n\n\n\n\n\nB.\u00a0 FIXES\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\n\u00a0AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral \n\n\n\n\u00a0An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.\n\n\n\n\u00a0IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.\n\nAIX Level\u00a0Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05\u00a0SP13\n\n\n\n\n\nPowerVM VIOS LevelFix PackVIOS 4.1.2\u00a04.1.2.20VIOS 4.1.1\u00a04.1.1.30VIOS 4.1.0\u00a0\u00a04.1.0.50\n\n\n\n\n\n\n\nNote: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .\n\n\n\nNote: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:\n https://www.ibm.com/support/pages/node/7283157 \n\n\n\nNote: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\n\n\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819 \n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823"
}
],
"title": "Vulnerabilities in IBM AIX and PowerVM VIOS"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-16656",
"datePublished": "2026-08-19T14:55:53.967Z",
"dateReserved": "2026-07-22T19:23:22.019Z",
"dateUpdated": "2026-08-20T18:28:38.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16232 (GCVE-0-2026-16232)
Vulnerability from cvelistv5 – Published: 2026-07-22 13:53 – Updated: 2026-08-10 18:34
VLAI
EPSS
VEX
Title
Authentication Bypass in the SmartConsole Login Process Using an Application Token
Summary
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
Severity
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-23 03:55 UTC
CWE
- CWE-287 - Improper Authentication.
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://support.checkpoint.com/results/sk/sk185169 | |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| checkpoint | Quantum Security Management |
Affected:
R82.10 with Jumbo Hotfix Take 36 or below
Affected: R82 with Jumbo Hotfix Take 118 or below Affected: R81.20 with Jumbo Hotfix Take 158 or below Affected: R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30 |
|
| checkpoint | Multi-Domain Security Management |
Affected:
R82.10 with Jumbo Hotfix Take 36 or below
Affected: R82 with Jumbo Hotfix Take 118 or below Affected: R81.20 with Jumbo Hotfix Take 158 or below Affected: R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16232",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-23T03:55:51.690584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-07-22",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T18:34:01.548Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Quantum Security Management",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 36 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 118 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 158 or below"
},
{
"status": "affected",
"version": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30"
}
]
},
{
"product": "Multi-Domain Security Management",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 36 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 118 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 158 or below"
},
{
"status": "affected",
"version": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication.",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-02T07:06:06.363Z",
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint"
},
"references": [
{
"url": "https://support.checkpoint.com/results/sk/sk185169"
}
],
"title": "Authentication Bypass in the SmartConsole Login Process Using an Application Token",
"x_generator": {
"engine": "cveClient/1.0.25"
}
}
},
"cveMetadata": {
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"assignerShortName": "checkpoint",
"cveId": "CVE-2026-16232",
"datePublished": "2026-07-22T13:53:09.830Z",
"dateReserved": "2026-07-19T12:14:17.233Z",
"dateUpdated": "2026-08-10T18:34:01.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16210 (GCVE-0-2026-16210)
Vulnerability from cvelistv5 – Published: 2026-07-19 03:15 – Updated: 2026-07-21 14:38
VLAI
EPSS
VEX
Title
newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication
Summary
A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 14:36 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380026 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380026/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16210 | third-party-advisory |
| https://vuldb.com/submit/857929 | third-party-advisory |
| https://github.com/newpanjing/simpleui/issues/537 | exploitissue-tracking |
| https://github.com/newpanjing/simpleui/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| newpanjing | simpleui |
Affected:
2026.01.13
cpe:2.3:a:newpanjing:simpleui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16210",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T14:36:01.543597Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T14:38:35.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:newpanjing:simpleui:*:*:*:*:*:*:*:*"
],
"modules": [
"AjaxAdmin AJAX Endpoint"
],
"product": "simpleui",
"vendor": "newpanjing",
"versions": [
{
"status": "affected",
"version": "2026.01.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Galaxyn (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T03:15:08.240Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380026 | newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380026"
},
{
"name": "VDB-380026 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380026/cti"
},
{
"name": "CVE-2026-16210 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16210"
},
{
"name": "Submit #857929 | newpanjing simpleui 2026.01.13 at commit 85b887022217b4e46c9a34d227dbf38fef1e7a92 CWE-862 Missing Authorization / CWE-863 Incorrect Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/857929"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/newpanjing/simpleui/issues/537"
},
{
"tags": [
"product"
],
"url": "https://github.com/newpanjing/simpleui/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-18T10:37:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16210",
"datePublished": "2026-07-19T03:15:08.240Z",
"dateReserved": "2026-07-18T08:32:01.295Z",
"dateUpdated": "2026-07-21T14:38:35.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16209 (GCVE-0-2026-16209)
Vulnerability from cvelistv5 – Published: 2026-07-19 03:00 – Updated: 2026-07-20 12:14 X_Open Source
VLAI
EPSS
VEX
Title
Gerapy Project Upload Endpoint views.py missing authentication
Summary
A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 12:08 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380025 | vdb-entry |
| https://vuldb.com/vuln/380025/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16209 | third-party-advisory |
| https://vuldb.com/submit/857926 | third-party-advisory |
| https://github.com/Gerapy/Gerapy/issues/317 | exploitissue-tracking |
| https://github.com/Gerapy/Gerapy/pull/319 | issue-trackingpatch |
| https://github.com/Gerapy/Gerapy/commit/bd4891c60… | patch |
| https://github.com/Gerapy/Gerapy/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Gerapy |
Affected:
0.9.0
Affected: 0.9.1 Affected: 0.9.2 Affected: 0.9.3 Affected: 0.9.4 Affected: 0.9.5 Affected: 0.9.6 Affected: 0.9.7 Affected: 0.9.8 Affected: 0.9.9 Affected: 0.9.10 Affected: 0.9.11 Affected: 0.9.12 Affected: 0.9.13 cpe:2.3:a:gerapy:gerapy:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16209",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T12:08:57.457117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T12:14:14.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gerapy:gerapy:*:*:*:*:*:*:*:*"
],
"modules": [
"Project Upload Endpoint"
],
"product": "Gerapy",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "0.9.0"
},
{
"status": "affected",
"version": "0.9.1"
},
{
"status": "affected",
"version": "0.9.2"
},
{
"status": "affected",
"version": "0.9.3"
},
{
"status": "affected",
"version": "0.9.4"
},
{
"status": "affected",
"version": "0.9.5"
},
{
"status": "affected",
"version": "0.9.6"
},
{
"status": "affected",
"version": "0.9.7"
},
{
"status": "affected",
"version": "0.9.8"
},
{
"status": "affected",
"version": "0.9.9"
},
{
"status": "affected",
"version": "0.9.10"
},
{
"status": "affected",
"version": "0.9.11"
},
{
"status": "affected",
"version": "0.9.12"
},
{
"status": "affected",
"version": "0.9.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Galaxyn (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T03:00:11.685Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380025 | Gerapy Project Upload Endpoint views.py missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/380025"
},
{
"name": "VDB-380025 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380025/cti"
},
{
"name": "CVE-2026-16209 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16209"
},
{
"name": "Submit #857926 | Gerapy 0.9.13 / master branch at commit 7c4eda875563f5d0342a3650959e0502bc279d77 CWE-862 Missing Authorization / CWE-434 Unrestricted Upload of F",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/857926"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Gerapy/Gerapy/issues/317"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Gerapy/Gerapy/pull/319"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Gerapy/Gerapy/commit/bd4891c60315f17611a3b7a651ffe0fba7cfe71e"
},
{
"tags": [
"product"
],
"url": "https://github.com/Gerapy/Gerapy/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-18T10:34:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "Gerapy Project Upload Endpoint views.py missing authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16209",
"datePublished": "2026-07-19T03:00:11.685Z",
"dateReserved": "2026-07-18T08:29:13.523Z",
"dateUpdated": "2026-07-20T12:14:14.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16198 (GCVE-0-2026-16198)
Vulnerability from cvelistv5 – Published: 2026-07-18 23:30 – Updated: 2026-07-21 14:32 X_Open Source
VLAI
EPSS
VEX
Title
Sipeed PicoClaw First Run Setup access_control.go authentication bypass
Summary
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go of the component First Run Setup. Performing a manipulation of the argument allowed_cidrs results in authentication bypass using alternate channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. The patch is named 017601354be38cb027ff3ffb01aed79bd5d12610. Applying a patch is the recommended action to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 14:31 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/380014 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/380014/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16198 | third-party-advisory |
| https://vuldb.com/submit/852965 | third-party-advisory |
| https://github.com/sipeed/picoclaw/issues/3080 | exploitissue-tracking |
| https://github.com/sipeed/picoclaw/pull/3083 | issue-trackingpatch |
| https://github.com/sipeed/picoclaw/commit/0176013… | patch |
| https://github.com/sipeed/picoclaw/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16198",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T14:31:37.887675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T14:32:20.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"First Run Setup"
],
"product": "PicoClaw",
"vendor": "Sipeed",
"versions": [
{
"status": "affected",
"version": "0.2.0"
},
{
"status": "affected",
"version": "0.2.1"
},
{
"status": "affected",
"version": "0.2.2"
},
{
"status": "affected",
"version": "0.2.3"
},
{
"status": "affected",
"version": "0.2.4"
},
{
"status": "affected",
"version": "0.2.5"
},
{
"status": "affected",
"version": "0.2.6"
},
{
"status": "affected",
"version": "0.2.7"
},
{
"status": "affected",
"version": "0.2.8"
},
{
"status": "affected",
"version": "0.2.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-i (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go of the component First Run Setup. Performing a manipulation of the argument allowed_cidrs results in authentication bypass using alternate channel. The attack may be initiated remotely. The attack\u0027s complexity is rated as high. The exploitability is regarded as difficult. The exploit is now public and may be used. The patch is named 017601354be38cb027ff3ffb01aed79bd5d12610. Applying a patch is the recommended action to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.1,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using Alternate Channel",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T23:30:18.741Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-380014 | Sipeed PicoClaw First Run Setup access_control.go authentication bypass",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/380014"
},
{
"name": "VDB-380014 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/380014/cti"
},
{
"name": "CVE-2026-16198 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16198"
},
{
"name": "Submit #852965 | Sipeed PicoClaw \u003c= v0.2.9 Authentication Bypass Using an Alternate Path or Channel (CWE-288)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852965"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/sipeed/picoclaw/issues/3080"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/sipeed/picoclaw/pull/3083"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sipeed/picoclaw/commit/017601354be38cb027ff3ffb01aed79bd5d12610"
},
{
"tags": [
"product"
],
"url": "https://github.com/sipeed/picoclaw/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-18T09:28:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "Sipeed PicoClaw First Run Setup access_control.go authentication bypass"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16198",
"datePublished": "2026-07-18T23:30:18.741Z",
"dateReserved": "2026-07-18T07:22:40.821Z",
"dateUpdated": "2026-07-21T14:32:20.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16083 (GCVE-0-2026-16083)
Vulnerability from cvelistv5 – Published: 2026-07-18 08:30 – Updated: 2026-07-20 17:36
VLAI
EPSS
VEX
Title
Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay
Summary
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 17:35 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379795 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379795/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16083 | third-party-advisory |
| https://vuldb.com/submit/852945 | third-party-advisory |
| https://github.com/sipeed/picoclaw/issues/3073 | exploitissue-tracking |
| https://github.com/sipeed/picoclaw/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16083",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T17:35:22.265497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T17:36:15.416Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"LINE Webhook"
],
"product": "PicoClaw",
"vendor": "Sipeed",
"versions": [
{
"status": "affected",
"version": "0.2.0"
},
{
"status": "affected",
"version": "0.2.1"
},
{
"status": "affected",
"version": "0.2.2"
},
{
"status": "affected",
"version": "0.2.3"
},
{
"status": "affected",
"version": "0.2.4"
},
{
"status": "affected",
"version": "0.2.5"
},
{
"status": "affected",
"version": "0.2.6"
},
{
"status": "affected",
"version": "0.2.7"
},
{
"status": "affected",
"version": "0.2.8"
},
{
"status": "affected",
"version": "0.2.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-i (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically with the label \"not planned\" by a bot."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T08:30:09.134Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379795 | Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379795"
},
{
"name": "VDB-379795 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379795/cti"
},
{
"name": "CVE-2026-16083 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16083"
},
{
"name": "Submit #852945 | Sipeed PicoClaw \u003c= 0.2.9 Authentication Bypass by Capture-replay (CWE-294)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852945"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/sipeed/picoclaw/issues/3073"
},
{
"tags": [
"product"
],
"url": "https://github.com/sipeed/picoclaw/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T15:55:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16083",
"datePublished": "2026-07-18T08:30:09.134Z",
"dateReserved": "2026-07-17T13:50:03.053Z",
"dateUpdated": "2026-07-20T17:36:15.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16076 (GCVE-0-2026-16076)
Vulnerability from cvelistv5 – Published: 2026-07-18 05:30 – Updated: 2026-07-20 19:10
VLAI
EPSS
VEX
Title
AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing
Summary
A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-20 16:59 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379791 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379791/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16076 | third-party-advisory |
| https://vuldb.com/submit/852864 | third-party-advisory |
| https://gist.github.com/YLChen-007/080ba55a71588d… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AstrBotDevs | AstrBot |
Affected:
4.25.0
Affected: 4.25.1 Affected: 4.25.2 Affected: 4.25.3 Affected: 4.25.4 Affected: 4.25.5 cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16076",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-20T16:59:26.768141Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:10:52.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*"
],
"modules": [
"API"
],
"product": "AstrBot",
"vendor": "AstrBotDevs",
"versions": [
{
"status": "affected",
"version": "4.25.0"
},
{
"status": "affected",
"version": "4.25.1"
},
{
"status": "affected",
"version": "4.25.2"
},
{
"status": "affected",
"version": "4.25.3"
},
{
"status": "affected",
"version": "4.25.4"
},
{
"status": "affected",
"version": "4.25.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-d (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T05:30:08.451Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379791 | AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379791"
},
{
"name": "VDB-379791 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379791/cti"
},
{
"name": "CVE-2026-16076 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16076"
},
{
"name": "Submit #852864 | AstrBotDevs AstrBot \u003c= 4.25.5 Authentication Bypass by Spoofing (CWE-290)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852864"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/080ba55a71588dbbba3f27afed4c072c"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T15:45:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16076",
"datePublished": "2026-07-18T05:30:08.451Z",
"dateReserved": "2026-07-17T13:39:29.721Z",
"dateUpdated": "2026-07-20T19:10:52.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16015 (GCVE-0-2026-16015)
Vulnerability from cvelistv5 – Published: 2026-07-17 13:15 – Updated: 2026-07-17 18:05 X_Open Source
VLAI
EPSS
VEX
Title
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
Summary
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 17:27 UTC
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379757 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379757/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16015 | third-party-advisory |
| https://vuldb.com/submit/856812 | third-party-advisory |
| https://vuldb.com/submit/856813 | third-party-advisory |
| https://vuldb.com/submit/856815 | third-party-advisory |
| https://vuldb.com/submit/856816 | third-party-advisory |
| https://github.com/poco-ai/poco-claw/issues/136 | exploitissue-tracking |
| https://github.com/poco-ai/poco-claw/pull/135 | exploitissue-trackingpatch |
| https://github.com/poco-ai/poco-claw/issues/137 | exploitissue-tracking |
| https://github.com/poco-ai/poco-claw/commit/67fcc… | exploitpatch |
| https://github.com/poco-ai/poco-claw/releases/tag/0.5.7 | exploitpatch |
| https://github.com/poco-ai/poco-claw/ | exploitproduct |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16015",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T17:27:54.707853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T18:05:31.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:poco-ai:poco-claw:*:*:*:*:*:*:*:*"
],
"modules": [
"executor_manager API"
],
"product": "poco-claw",
"vendor": "poco-ai",
"versions": [
{
"status": "affected",
"version": "0.5.0"
},
{
"status": "affected",
"version": "0.5.1"
},
{
"status": "affected",
"version": "0.5.2"
},
{
"status": "affected",
"version": "0.5.3"
},
{
"status": "affected",
"version": "0.5.4"
},
{
"status": "unaffected",
"version": "0.5.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erichen (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T13:15:12.605Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379757 | poco-ai poco-claw executor_manager API tasks.py create_task missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379757"
},
{
"name": "VDB-379757 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379757/cti"
},
{
"name": "CVE-2026-16015 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16015"
},
{
"name": "Submit #856812 | poco-ai poco-agent 0.5.4 Missing Authentication for Critical Function (CWE-306)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856812"
},
{
"name": "Submit #856813 | poco-ai poco-agent 0.5.4 Missing Authentication for Critical Function (CWE-306) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856813"
},
{
"name": "Submit #856815 | poco-ai poco-agent 0.5.4 Missing Authentication for Critical Function (CWE-306) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856815"
},
{
"name": "Submit #856816 | poco-ai poco-agent 0.5.4 Authorization Bypass Through User-Controlled Key (CWE-639) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856816"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/poco-ai/poco-claw/issues/136"
},
{
"tags": [
"exploit",
"issue-tracking",
"patch"
],
"url": "https://github.com/poco-ai/poco-claw/pull/135"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/poco-ai/poco-claw/issues/137"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://github.com/poco-ai/poco-claw/commit/67fcc88505c57f77d3fcf04eb5b89425b10cbf48"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://github.com/poco-ai/poco-claw/releases/tag/0.5.7"
},
{
"tags": [
"exploit",
"product"
],
"url": "https://github.com/poco-ai/poco-claw/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T07:49:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "poco-ai poco-claw executor_manager API tasks.py create_task missing authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16015",
"datePublished": "2026-07-17T13:15:12.605Z",
"dateReserved": "2026-07-17T05:44:00.706Z",
"dateUpdated": "2026-07-17T18:05:31.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15981 (GCVE-0-2026-15981)
Vulnerability from cvelistv5 – Published: 2026-07-23 20:33 – Updated: 2026-07-24 22:06
VLAI
EPSS
VEX
Title
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
Summary
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 22:05 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cyberlord92 | SAML Single Sign On – SSO Login |
Affected:
0 , ≤ 5.4.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T22:05:57.054951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T22:06:10.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAML Single Sign On \u2013 SSO Login",
"vendor": "cyberlord92",
"versions": [
{
"lessThanOrEqual": "5.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SAML Single Sign On \u2013 SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP\u0027s openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error \u2014 bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T20:33:51.362Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b412f60f-61ea-47b1-a3ef-17275f7951df?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-login-validate.php#L118"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-utilities.php#L403"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/includes/lib/SAML2Core/class-mo-saml-xml-security-dsig.php#L938"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/includes/lib/SAML2Core/class-mo-saml-xml-security-key.php#L621"
},
{
"url": "https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-login-validate.php#L541"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3611421/miniorange-saml-20-single-sign-on"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-16T17:11:08.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-23T08:24:20.000Z",
"value": "Disclosed"
}
],
"title": "SAML Single Sign On \u003c= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15981",
"datePublished": "2026-07-23T20:33:51.362Z",
"dateReserved": "2026-07-16T16:55:30.527Z",
"dateUpdated": "2026-07-24T22:06:10.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15557 (GCVE-0-2026-15557)
Vulnerability from cvelistv5 – Published: 2026-07-13 09:30 – Updated: 2026-07-13 18:11
VLAI
EPSS
VEX
Title
waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication
Summary
A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 18:07 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377906 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/377906/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15557 | third-party-advisory |
| https://vuldb.com/submit/855187 | third-party-advisory |
| https://github.com/waooAI/waoowaoo/issues/200 | exploitissue-tracking |
| https://github.com/waooAI/waoowaoo/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15557",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T18:07:18.524271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T18:11:46.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:waooai:waoowaoo:*:*:*:*:*:*:*:*"
],
"modules": [
"Internal Task Header Handler"
],
"product": "waoowaoo",
"vendor": "waooAI",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T09:30:09.319Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377906 | waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/377906"
},
{
"name": "VDB-377906 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377906/cti"
},
{
"name": "CVE-2026-15557 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15557"
},
{
"name": "Submit #855187 | waooAI waoowaoo 0.4.1 Improper Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/855187"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/waooAI/waoowaoo/issues/200"
},
{
"tags": [
"product"
],
"url": "https://github.com/waooAI/waoowaoo/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-13T07:08:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15557",
"datePublished": "2026-07-13T09:30:09.319Z",
"dateReserved": "2026-07-13T05:03:01.385Z",
"dateUpdated": "2026-07-13T18:11:46.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.