CWE-288
AllowedAuthentication Bypass Using an Alternate Path or Channel
Abstraction: Base · Status: Incomplete
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
1280 vulnerabilities reference this CWE, most recent first.
GHSA-V4MR-PQHX-VPM2
Vulnerability from github – Published: 2025-01-14 15:30 – Updated: 2025-10-22 00:33An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
{
"affected": [],
"aliases": [
"CVE-2024-55591"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-14T14:15:34Z",
"severity": "CRITICAL"
},
"details": "An\u00a0Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to\u00a0Node.js websocket module.",
"id": "GHSA-v4mr-pqhx-vpm2",
"modified": "2025-10-22T00:33:11Z",
"published": "2025-01-14T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55591"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55591"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-V7PW-9CMM-88M6
Vulnerability from github – Published: 2023-09-06 18:30 – Updated: 2025-10-22 00:32A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.
This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following:
Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).
Notes:
Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured.
Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-20269"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-06T18:15:08Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.\n\n This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following:\n\n \n Identify valid credentials that could then be used to establish an unauthorized remote access VPN session.\n Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).\n \n Notes:\n\n \n Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured.\n This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured.\n \n Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.",
"id": "GHSA-v7pw-9cmm-88m6",
"modified": "2025-10-22T00:32:51Z",
"published": "2023-09-06T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20269"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20269"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V7R3-HXVJ-7W2P
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-19 21:31Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.
{
"affected": [],
"aliases": [
"CVE-2025-13018"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T16:15:38Z",
"severity": "HIGH"
},
"details": "Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u003c 145 and Firefox ESR \u003c 140.5.",
"id": "GHSA-v7r3-hxvj-7w2p",
"modified": "2025-11-19T21:31:17Z",
"published": "2025-11-11T18:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13018"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1984940"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-87"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-88"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-90"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-91"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V822-XRFP-FV6Q
Vulnerability from github – Published: 2026-10-08 06:31 – Updated: 2026-10-14 21:33An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.
{
"affected": [],
"aliases": [
"CVE-2026-94585"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-08T05:17:06Z",
"severity": "HIGH"
},
"details": "An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.",
"id": "GHSA-v822-xrfp-fv6q",
"modified": "2026-10-14T21:33:07Z",
"published": "2026-10-08T06:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94585"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/39134"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V865-P3GQ-HW6M
Vulnerability from github – Published: 2026-03-03 21:25 – Updated: 2026-03-30 13:21Summary (Updated March 2, 2026)
Encoded alternate-path requests could bypass plugin route auth checks for /api/channels/* due to canonicalization depth mismatch in vulnerable builds.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published vulnerable version:
2026.3.1 - Affected range:
<= 2026.3.1 - Patched release:
2026.3.2(patched_versions: >= 2026.3.2)
Technical Details
In affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded %2f). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to /api/channels/... in plugin route handling.
The fix set hardens this class of issue by: - canonicalizing route paths to a bounded fixpoint, - failing closed on malformed or unresolved canonicalization depth, - requiring explicit plugin-route auth contracts (no implicit auth default), - enforcing route ownership/conflict guards for duplicate route registrations, and - using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.
Affected Deployments
Deployments exposing plugin HTTP routes and relying on gateway auth for /api/channels/* protection.
Fix Commit(s)
93b07240257919f770d1e263e1f22753937b80ea2fd8264ab03bd178e62a5f0c50d1c8556c17f12dd74bc257d8432f17e50b23ae713d7e0623a1fe0f7a7eee920a176a0043398c6b37bf4cc6eb983eeb
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.1"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32004"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-03T21:25:52Z",
"nvd_published_at": "2026-03-19T22:16:32Z",
"severity": "HIGH"
},
"details": "### Summary (Updated March 2, 2026)\nEncoded alternate-path requests could bypass plugin route auth checks for `/api/channels/*` due to canonicalization depth mismatch in vulnerable builds.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published vulnerable version: `2026.3.1`\n- Affected range: `\u003c= 2026.3.1`\n- Patched release: `2026.3.2` (`patched_versions: \u003e= 2026.3.2`)\n\n### Technical Details\nIn affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded `%2f`). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to `/api/channels/...` in plugin route handling.\n\nThe fix set hardens this class of issue by:\n- canonicalizing route paths to a bounded fixpoint,\n- failing closed on malformed or unresolved canonicalization depth,\n- requiring explicit plugin-route auth contracts (no implicit auth default),\n- enforcing route ownership/conflict guards for duplicate route registrations, and\n- using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.\n\n### Affected Deployments\nDeployments exposing plugin HTTP routes and relying on gateway auth for `/api/channels/*` protection.\n\n### Fix Commit(s)\n- `93b07240257919f770d1e263e1f22753937b80ea`\n- `2fd8264ab03bd178e62a5f0c50d1c8556c17f12d`\n- `d74bc257d8432f17e50b23ae713d7e0623a1fe0f`\n- `7a7eee920a176a0043398c6b37bf4cc6eb983eeb`",
"id": "GHSA-v865-p3gq-hw6m",
"modified": "2026-03-30T13:21:06Z",
"published": "2026-03-03T21:25:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-v865-p3gq-hw6m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32004"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/2fd8264ab03bd178e62a5f0c50d1c8556c17f12d"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/7a7eee920a176a0043398c6b37bf4cc6eb983eeb"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/93b07240257919f770d1e263e1f22753937b80ea"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/d74bc257d8432f17e50b23ae713d7e0623a1fe0f"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-encoded-path-in-api-channels-route"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification"
}
GHSA-V988-828W-XVF2
Vulnerability from github – Published: 2021-10-22 16:21 – Updated: 2021-10-21 21:36Impact
rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the webui within a close timeframe, thus allowing users to access the webui with the leaked authentication token. Privileges are therefore also escalated.
Rucio server / daemons are not affected by this issue, it is isolated to the webui.
Patches
This issue is fixed in the 1.26.7 release of the rucio-webui.
Workarounds
Installation of the 1.25.7 webui release. The 1.25 and previous webui release lines are not affected by this issue.
References
https://github.com/rucio/rucio/issues/4928
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "rucio-webui"
},
"ranges": [
{
"events": [
{
"introduced": "1.26.0"
},
{
"fixed": "1.26.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2021-10-21T21:36:22Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n`rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated.\n\nRucio server / daemons are not affected by this issue, it is isolated to the webui.\n\n### Patches\nThis issue is fixed in the `1.26.7` release of the `rucio-webui`.\n\n### Workarounds\nInstallation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue.\n\n### References\nhttps://github.com/rucio/rucio/issues/4928",
"id": "GHSA-v988-828w-xvf2",
"modified": "2021-10-21T21:36:22Z",
"published": "2021-10-22T16:21:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rucio/rucio/security/advisories/GHSA-v988-828w-xvf2"
},
{
"type": "WEB",
"url": "https://github.com/rucio/rucio/issues/4810"
},
{
"type": "WEB",
"url": "https://github.com/rucio/rucio/issues/4928"
},
{
"type": "WEB",
"url": "https://github.com/rucio/rucio/commit/8f832404ae88d6300e17d7e706b40fe58e0df90c"
},
{
"type": "PACKAGE",
"url": "https://github.com/rucio/rucio"
},
{
"type": "WEB",
"url": "https://github.com/rucio/rucio/releases/tag/1.26.7"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui"
}
GHSA-VC32-4GWF-77XP
Vulnerability from github – Published: 2026-10-15 20:14 – Updated: 2026-10-15 20:14Summary
An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through /mcp and /mcp_message using only ordinary authentication.
Details
The HTTP configuration mutation surface is explicitly grouped behind middleware.RequireSecureSession(). By contrast, the MCP endpoints are exposed with only middleware.AuthRequired(). The MCP server exposes configuration mutation tools including nginx_config_add and nginx_config_modify, so OTP-enabled users gain an alternate path around the intended step-up requirement.
Relevant code paths: - api/config/router.go - internal/middleware/secure_session.go - mcp/router.go - mcp/config/config_add.go - mcp/config/config_modify.go
This is a security-control bypass rather than a missing feature. The product already established that OTP-enabled users should complete a secure session before high-impact configuration mutations are accepted on the HTTP path.
PoC
I verified this locally in an isolated environment with a temporary end-to-end harness that exercised the real /mcp and /mcp_message routes.
What the executed test did:
1. Created a temporary config directory and configured Nginx control commands to harmless local values (true) to avoid touching the host.
2. Created a real OTP-enabled user in a temporary SQLite database.
3. Generated a real JWT for that OTP-enabled user.
4. Started a local test server exposing the real /mcp and /mcp_message routes.
5. Opened an authenticated SSE connection to /mcp with the JWT and no X-Secure-Session-ID.
6. Initialized the MCP session over /mcp_message.
7. Called the real nginx_config_add tool over /mcp_message.
8. Verified that the tool succeeded and created mcp-bypass.conf in the managed config directory without any secure-session step-up.
Observed result from the actual local verification:
- The MCP session initialized successfully without any X-Secure-Session-ID.
- The config file was written through the MCP tool path using only JWT authentication.
Impact
OTP-enabled accounts lose the intended step-up protection for high-impact Nginx configuration changes when MCP is enabled. A user who should be blocked until re-authenticating can still create or modify configuration files and trigger reload behavior through MCP.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/0xJacky/Nginx-UI"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.10-0.20260703131214-23d1934099b0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-84360"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-15T20:14:10Z",
"nvd_published_at": "2026-10-12T21:17:22Z",
"severity": "HIGH"
},
"details": "### Summary\nAn OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through `/mcp` and `/mcp_message` using only ordinary authentication.\n\n### Details\nThe HTTP configuration mutation surface is explicitly grouped behind `middleware.RequireSecureSession()`. By contrast, the MCP endpoints are exposed with only `middleware.AuthRequired()`. The MCP server exposes configuration mutation tools including `nginx_config_add` and `nginx_config_modify`, so OTP-enabled users gain an alternate path around the intended step-up requirement.\n\nRelevant code paths:\n- [api/config/router.go](/home/kali/Desktop/bounty/nginx-ui/api/config/router.go:14)\n- [internal/middleware/secure_session.go](/home/kali/Desktop/bounty/nginx-ui/internal/middleware/secure_session.go:52)\n- [mcp/router.go](/home/kali/Desktop/bounty/nginx-ui/mcp/router.go:9)\n- [mcp/config/config_add.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_add.go:34)\n- [mcp/config/config_modify.go](/home/kali/Desktop/bounty/nginx-ui/mcp/config/config_modify.go:55)\n\nThis is a security-control bypass rather than a missing feature. The product already established that OTP-enabled users should complete a secure session before high-impact configuration mutations are accepted on the HTTP path.\n\n### PoC\nI verified this locally in an isolated environment with a temporary end-to-end harness that exercised the real `/mcp` and `/mcp_message` routes.\n\nWhat the executed test did:\n1. Created a temporary config directory and configured Nginx control commands to harmless local values (`true`) to avoid touching the host.\n2. Created a real OTP-enabled user in a temporary SQLite database.\n3. Generated a real JWT for that OTP-enabled user.\n4. Started a local test server exposing the real `/mcp` and `/mcp_message` routes.\n5. Opened an authenticated SSE connection to `/mcp` with the JWT and no `X-Secure-Session-ID`.\n6. Initialized the MCP session over `/mcp_message`.\n7. Called the real `nginx_config_add` tool over `/mcp_message`.\n8. Verified that the tool succeeded and created `mcp-bypass.conf` in the managed config directory without any secure-session step-up.\n\nObserved result from the actual local verification:\n- The MCP session initialized successfully without any `X-Secure-Session-ID`.\n- The config file was written through the MCP tool path using only JWT authentication.\n\n### Impact\nOTP-enabled accounts lose the intended step-up protection for high-impact Nginx configuration changes when MCP is enabled. A user who should be blocked until re-authenticating can still create or modify configuration files and trigger reload behavior through MCP.",
"id": "GHSA-vc32-4gwf-77xp",
"modified": "2026-10-15T20:14:10Z",
"published": "2026-10-15T20:14:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84360"
},
{
"type": "WEB",
"url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
},
{
"type": "PACKAGE",
"url": "https://github.com/0xJacky/nginx-ui"
},
{
"type": "WEB",
"url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools"
}
GHSA-VC38-C3PM-PR72
Vulnerability from github – Published: 2025-10-06 09:30 – Updated: 2025-10-06 09:30The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.
{
"affected": [],
"aliases": [
"CVE-2025-9914"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-06T07:15:36Z",
"severity": "MODERATE"
},
"details": "The credentials of the users stored in the system\u0027s local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.",
"id": "GHSA-vc38-c3pm-pr72",
"modified": "2025-10-06T09:30:20Z",
"published": "2025-10-06T09:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9914"
},
{
"type": "WEB",
"url": "https://sick.com/psirt"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"type": "WEB",
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.json"
},
{
"type": "WEB",
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0010.pdf"
},
{
"type": "WEB",
"url": "https://www.sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VCWP-4M7W-HXFH
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-19 21:31Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.
{
"affected": [],
"aliases": [
"CVE-2025-13013"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T16:15:38Z",
"severity": "MODERATE"
},
"details": "Mitigation bypass in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 145, Firefox ESR \u003c 140.5, and Firefox ESR \u003c 115.30.",
"id": "GHSA-vcwp-4m7w-hxfh",
"modified": "2025-11-19T21:31:17Z",
"published": "2025-11-11T18:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13013"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1991945"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-87"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-88"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-89"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-90"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-91"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VFMJ-48R5-54J4
Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-17 18:35Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.
This issue affects MStore API: from n/a through 4.18.4.
{
"affected": [],
"aliases": [
"CVE-2026-54817"
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-17T14:17:59Z",
"severity": "MODERATE"
},
"details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation.\n\nThis issue affects MStore API: from n/a through 4.18.4.",
"id": "GHSA-vfmj-48r5-54j4",
"modified": "2026-06-17T18:35:55Z",
"published": "2026-06-17T18:35:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54817"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/mstore-api/vulnerability/wordpress-mstore-api-plugin-4-18-4-broken-authentication-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.