Common Weakness Enumeration
CWE-288
AllowedAuthentication Bypass Using an Alternate Path or Channel
Abstraction: Base · Status: Incomplete
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
1280 vulnerabilities reference this CWE, most recent first.
CVE-2026-94585 (GCVE-0-2026-94585)
Vulnerability from cvelistv5 – Published: 2026-10-08 04:40 – Updated: 2026-10-08 17:55
VLAI
EPSS
VEX
Summary
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 15:18 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T15:18:49.962411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:55:38.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Fabric OS",
"vendor": "Brocade",
"versions": [
{
"lessThan": "9.2.2d",
"status": "affected",
"version": "0",
"versionType": "Brocade FabricOS"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.\u003c/p\u003e"
}
],
"value": "An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288: Authentication Bypass Using an Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T04:40:08.718Z",
"orgId": "87b297d7-335e-4844-9551-11b97995a791",
"shortName": "brocade"
},
"references": [
{
"url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/39134"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eSecurity update is provided in Brocade Fabric OS 9.2.2d and 10.0.1\u003c/div\u003e"
}
],
"value": "Security update is provided in Brocade Fabric OS 9.2.2d and 10.0.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "87b297d7-335e-4844-9551-11b97995a791",
"assignerShortName": "brocade",
"cveId": "CVE-2026-94585",
"datePublished": "2026-10-08T04:40:08.718Z",
"dateReserved": "2026-09-21T20:30:18.739Z",
"dateUpdated": "2026-10-08T17:55:38.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93949 (GCVE-0-2026-93949)
Vulnerability from cvelistv5 – Published: 2026-10-10 07:00 – Updated: 2026-10-11 12:13 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:02 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/theme/g… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Omegathemes | Grocery Shopping Store |
Affected:
0 , ≤ 1.3.3
(custom)
|
Date Public
2026-10-08 06:31
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93949",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:02:13.582937Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:13:40.757Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "grocery-shopping-store",
"product": "Grocery Shopping Store",
"vendor": "Omegathemes",
"versions": [
{
"lessThanOrEqual": "1.3.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-08T06:31:21.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.\u003cp\u003eThis issue affects Grocery Shopping Store: from n/a through 1.3.3.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T07:00:34.180Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/theme/grocery-shopping-store/vulnerability/wordpress-grocery-shopping-store-theme-1-3-3-broken-authentication-vulnerability?_s_id=cve"
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Grocery Shopping Store theme \u003c= 1.3.3 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-93949",
"datePublished": "2026-10-10T07:00:34.180Z",
"dateReserved": "2026-09-19T00:23:25.966Z",
"dateUpdated": "2026-10-11T12:13:40.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93928 (GCVE-0-2026-93928)
Vulnerability from cvelistv5 – Published: 2026-09-22 08:42 – Updated: 2026-09-22 13:08 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability
Summary
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass.
This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 13:08 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Magepeople inc. | Taxi Booking Manager for WooCommerce |
Affected:
n/a , < 2.0.8
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T13:08:30.937153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T13:08:49.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "ecab-taxi-booking-manager",
"product": "Taxi Booking Manager for WooCommerce",
"vendor": "Magepeople inc.",
"versions": [
{
"changes": [
{
"at": "2.0.8",
"status": "unaffected"
}
],
"lessThan": "2.0.8",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Thaer Assfour | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass.\u003cp\u003eThis issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.\u003c/p\u003e"
}
],
"value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass.\n\nThis issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T08:42:37.147Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-2-0-8-broken-authentication-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Taxi Booking Manager for WooCommerce Plugin to the latest available version (at least 2.0.8)."
}
],
"value": "Update the WordPress Taxi Booking Manager for WooCommerce Plugin to the latest available version (at least 2.0.8)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress Taxi Booking Manager for WooCommerce plugin \u003c 2.0.8 - Broken Authentication vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-93928",
"datePublished": "2026-09-22T08:42:37.147Z",
"dateReserved": "2026-09-19T00:23:25.964Z",
"dateUpdated": "2026-09-22T13:08:49.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91143 (GCVE-0-2026-91143)
Vulnerability from cvelistv5 – Published: 2026-09-14 21:45 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
goproxy through 15.3 Authentication Bypass via CONNECT
Summary
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:12 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/goproxy.md | third-party-advisoryexploit |
| https://github.com/snail007/goproxy/blob/v15.3/ut… | technical-description |
| https://github.com/snail007/goproxy/blob/v15.3/se… | technical-description |
| https://github.com/snail007/goproxy | product |
| https://www.vulncheck.com/advisories/goproxy-thro… | third-party-advisory |
Impacted products
Date Public
2026-07-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91143",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:12:03.554598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:12:14.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/snail007/goproxy",
"product": "goproxy",
"repo": "https://github.com/snail007/goproxy",
"vendor": "snail007",
"versions": [
{
"lessThanOrEqual": "15.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:goproxy_project:goproxy:*:*:*:*:*:*:*:*",
"versionEndIncluding": "15.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:10.409Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/goproxy.md"
},
{
"name": "utils/structs.go at v15.3",
"tags": [
"technical-description"
],
"url": "https://github.com/snail007/goproxy/blob/v15.3/utils/structs.go"
},
{
"name": "services/http.go at v15.3",
"tags": [
"technical-description"
],
"url": "https://github.com/snail007/goproxy/blob/v15.3/services/http.go"
},
{
"tags": [
"product"
],
"url": "https://github.com/snail007/goproxy"
},
{
"name": "VulnCheck Advisory: goproxy through 15.3 Authentication Bypass via CONNECT",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/goproxy-through-15.3-authentication-bypass-via-connect"
}
],
"title": "goproxy through 15.3 Authentication Bypass via CONNECT",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91143",
"datePublished": "2026-09-14T21:45:43.908Z",
"dateReserved": "2026-09-14T20:35:39.074Z",
"dateUpdated": "2026-09-24T14:22:10.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90481 (GCVE-0-2026-90481)
Vulnerability from cvelistv5 – Published: 2026-09-24 14:14 – Updated: 2026-09-24 14:55
VLAI
EPSS
VEX
Summary
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 14:55 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portswigger.net/burp/releases/dast-2026-8 | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PortSwigger | Burp Suite DAST |
Affected:
2021.11 , < 2026.8
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T14:55:22.193962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:55:31.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Burp Suite DAST",
"vendor": "PortSwigger",
"versions": [
{
"lessThan": "2026.8",
"status": "affected",
"version": "2021.11",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:14:18.341Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://portswigger.net/burp/releases/dast-2026-8"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Burp Suite DAST 2026.8 or later."
}
],
"value": "Upgrade to Burp Suite DAST 2026.8 or later."
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-90481",
"datePublished": "2026-09-24T14:14:18.341Z",
"dateReserved": "2026-09-12T02:49:29.536Z",
"dateUpdated": "2026-09-24T14:55:31.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89067 (GCVE-0-2026-89067)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:05 – Updated: 2026-10-15 10:31
VLAI
EPSS
VEX
Title
MOVEit Transfer Secure Messaging Authentication Bypass
Summary
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 03:57 UTC
CWE
- CWE-288 - Authentication bypass using an alternate path or channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://community.progress.com/s/article/MOVEit-T… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress | MOVEit Transfer |
Affected:
0 , < 2025.1.6
(semver)
Affected: 2026.0.0 , < 2026.0.4 (semver) |
Date Public
2026-10-14 15:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89067",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T03:57:09.155363Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T10:31:15.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MOVEit Transfer",
"vendor": "Progress",
"versions": [
{
"lessThan": "2025.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2026.0.4",
"status": "affected",
"version": "2026.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Leo Oliver (ssrfer)"
}
],
"datePublic": "2026-10-14T15:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\u003cp\u003eThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.\u003c/p\u003e"
}
],
"value": "Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.\n\nThis issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:05:26.675Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin---September-2026"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MOVEit Transfer Secure Messaging Authentication Bypass",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-89067",
"datePublished": "2026-10-14T15:05:26.675Z",
"dateReserved": "2026-09-10T18:47:56.871Z",
"dateUpdated": "2026-10-15T10:31:15.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89057 (GCVE-0-2026-89057)
Vulnerability from cvelistv5 – Published: 2026-10-15 23:17 – Updated: 2026-10-16 18:58
VLAI
EPSS
VEX
Summary
A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:57 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.lenovo.com/us/en/product_security… | vendor-advisory |
Impacted products
31 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Idea Tab Pro (TB373FU) |
Affected:
0 , < 17.5.10.107
(custom)
cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) |
Affected:
0 , < 17.5.10.348
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU) |
Affected:
0 , < TB336FU：17.5.10.348 ,TB336ZU：17.5.10.354
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU) |
Affected:
0 , < 17.5.10.354
(custom)
cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Legion Tab (8.8", 3) (TB321FU) |
Affected:
0 , < 17.5.10.319
(custom)
cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330FU/TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330fu_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M11 (TB330XU) |
Affected:
0 , < 17.0.517
(custom)
cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570FU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Extreme (TB570ZU/TB570FU) |
Affected:
0 , < 17.5.589
(custom)
cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330FUP) |
Affected:
0 , < 17.0.135
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 (TB330XUP) |
Affected:
0 , < 17.0.157
(custom)
cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352FU) |
Affected:
0 , < 17.0.10.344
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus (TB352XU) |
Affected:
0 , < 17.0.10.336
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus LTE ROW (TB352XU) |
Affected:
0 , < 17.0.10.336
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K11 Plus WIFI ROW: TB352FU |
Affected:
0 , < 17.0.10.344
(custom)
cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab M10 5G (TB360ZU) |
Affected:
0 , < 16.0.939
(custom)
cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305FU) |
Affected:
0 , < 17.0.10.324
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab K9 (TB305XU) |
Affected:
0 , < 17.0.10.318
(custom)
cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305FU) |
Affected:
0 , < 17.0.10.324
(custom)
cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab One (TB305XU) |
Affected:
0 , < 17.0.10.254
(custom)
cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU) |
Affected:
0 , < 17.0.352
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB370FU/TB372FU) |
Affected:
0 , < TB370FU：17.0.352, TB372FC：17.0.223
(custom)
cpe:2.3:a:lenovo:tab_p12_tb370fu_tb372fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab P12 (TB372FU) |
Affected:
0 , < 17.0.223
(custom)
cpe:2.3:a:lenovo:tab_p12_tb372fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab Plus (TB351FU) |
Affected:
0 , < 17.5.10.199
(custom)
cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU) |
Affected:
0 , < 17.5.36.417
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU) |
Affected:
0 , < TB311FU：17.5.36.417 ,TB311XU：17.5.37.350
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU) |
Affected:
0 , < 17.5.37.350
(custom)
cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab (TB710FU) |
Affected:
0 , < 17.5.04.082
(custom)
cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:* |
|
| Lenovo | Yoga Tab Plus (TB520FU) |
Affected:
0 , < 17.5.10.362
(custom)
cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89057",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:57:50.385384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:58:59.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Idea Tab Pro (TB373FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.107",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.348",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB336FU\uff1a17.5.10.348 ,TB336ZU\uff1a17.5.10.354",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Idea Tab/ Lenovo Tab K11 Gen 2 (TB336ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.354",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Legion Tab (8.8\", 3) (TB321FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.319",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330FU/TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M11 (TB330XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.517",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Extreme (TB570ZU/TB570FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.589",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330FUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.135",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 (TB330XUP)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.157",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.344",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.336",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus LTE ROW (TB352XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.336",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K11 Plus WIFI ROW: TB352FU",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.344",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab M10 5G (TB360ZU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "16.0.939",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.324",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab K9 (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.318",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.324",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab One (TB305XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.10.254",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.352",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB370FU/TB372FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB370FU\uff1a17.0.352, TB372FC\uff1a17.0.223",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab P12 (TB372FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.0.223",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab Plus (TB351FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.199",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.36.417",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "TB311FU\uff1a17.5.36.417 ,TB311XU\uff1a17.5.37.350",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tab with Clear Case/ Lenovo Tab with Folio Case (TB311XU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.37.350",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab (TB710FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.04.082",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Yoga Tab Plus (TB520FU)",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "17.5.10.362",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_pro_tb373fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.107",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.348",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336fu_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb336fu_17.5.10.348_tb336zu_17.5.10.354",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:idea_tab_lenovo_tab_k11_gen_2_tb336zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.354",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:legion_tab_8.8_3_tb321fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.319",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330fu_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m11_tb330xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.517",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_extreme_tb570zu_tb570fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.589",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330fup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.135",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_tb330xup_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.157",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.344",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.336",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_lte_row_tb352xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.336",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k11_plus_wifi_row_tb352fu:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.344",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_m10_5g_tb360zu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.0.939",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.324",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_k9_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.318",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.324",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_one_tb305xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.10.254",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.352",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb370fu_tb372fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb370fu_17.0.352_tb372fc_17.0.223",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_p12_tb372fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.223",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_plus_tb351fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.199",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.36.417",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311fu_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "tb311fu_17.5.36.417_tb311xu_17.5.37.350",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:tab_with_clear_case_lenovo_tab_with_folio_case_tb311xu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.37.350",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_tb710fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.04.082",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lenovo:yoga_tab_plus_tb520fu_:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.5.10.362",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks Deepak Toshniwal and Ayansh Toshniwal for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access."
}
],
"value": "A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T23:17:37.340Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the version (or higher) as recommended in the advisory -\u0026nbsp;https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"value": "Update to the version (or higher) as recommended in the advisory -\u00a0https://support.lenovo.com/us/en/product_security/LEN-218699"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2026-89057",
"datePublished": "2026-10-15T23:17:37.340Z",
"dateReserved": "2026-09-10T18:11:51.160Z",
"dateUpdated": "2026-10-16T18:58:59.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88861 (GCVE-0-2026-88861)
Vulnerability from cvelistv5 – Published: 2026-09-10 13:05 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
Summary
Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor that has not been used for the session: the Edge JWT middleware (foundJWT() in supabase/functions/_backend/utils/hono_middleware.ts) accepts the JWT without validating its assurance level, and the direct RBAC path (checkPermission()/checkPermissionPg() in supabase/functions/_backend/utils/rbac.ts calling public.rbac_check_permission_direct()) authorizes by user ID without passing or checking the session aal, unlike the public.verify_mfa() control which correctly requires aal2. An attacker who knows only the victim's password can therefore authenticate, mint a persistent app-scoped app_admin API key that remains valid after the aal1 session is logged out, and perform privileged operations such as modifying production OTA channel configurations (validated by changing a public production channel from bundle 1.0.0 to 1.0.1), defeating the protection provided by MFA.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:13 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Cap-go/capgo.app/security/advi… | vendor-advisory |
| https://www.vulncheck.com/advisories/capgo-aal1-s… | third-party-advisory |
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88861",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:13:22.833448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:13:46.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cap-go/capgo.app/security/advisories/GHSA-9435-5xw9-v29h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "capgo.app",
"vendor": "Cap-go",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Judel777"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor that has not been used for the session: the Edge JWT middleware (foundJWT() in supabase/functions/_backend/utils/hono_middleware.ts) accepts the JWT without validating its assurance level, and the direct RBAC path (checkPermission()/checkPermissionPg() in supabase/functions/_backend/utils/rbac.ts calling public.rbac_check_permission_direct()) authorizes by user ID without passing or checking the session aal, unlike the public.verify_mfa() control which correctly requires aal2. An attacker who knows only the victim\u0027s password can therefore authenticate, mint a persistent app-scoped app_admin API key that remains valid after the aal1 session is logged out, and perform privileged operations such as modifying production OTA channel configurations (validated by changing a public production channel from bundle 1.0.0 to 1.0.1), defeating the protection provided by MFA."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:32.771Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9435-5xw9-v29h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Cap-go/capgo.app/security/advisories/GHSA-9435-5xw9-v29h"
},
{
"name": "VulnCheck Advisory: Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/capgo-aal1-session-mfa-bypass-via-direct-rbac-authorization"
}
],
"title": "Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-88861",
"datePublished": "2026-09-10T13:05:18.415Z",
"dateReserved": "2026-09-10T11:23:56.026Z",
"dateUpdated": "2026-09-30T17:20:32.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88260 (GCVE-0-2026-88260)
Vulnerability from cvelistv5 – Published: 2026-09-11 02:29 – Updated: 2026-09-11 16:53
VLAI
EPSS
VEX
Summary
Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.
This issue affects Zenius EMS 8.0: through OAM (Build 109).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 16:48 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.brainz.co.kr/Features |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Brainzcompany | Zenius EMS 8.0 |
Affected:
0 , ≤ OAM (Build 109)
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T16:48:48.098012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T16:53:14.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Zenius EMS 8.0",
"vendor": "Brainzcompany",
"versions": [
{
"lessThanOrEqual": "OAM (Build 109)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "darbong(\uc774\ubbfc\ud76c)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.\u003cp\u003eThis issue affects Zenius EMS 8.0: through OAM (Build 109).\u003c/p\u003e"
}
],
"value": "Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code Inclusion.\n\nThis issue affects Zenius EMS 8.0: through OAM (Build 109)."
}
],
"impacts": [
{
"capecId": "CAPEC-253",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-253 Remote Code Inclusion"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication bypass using an alternate path or channel",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1286",
"description": "CWE-1286 Improper validation of syntactic correctness of input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T02:29:52.162Z",
"orgId": "09832df1-09c1-45b4-8a85-16c601d30feb",
"shortName": "FSI"
},
"references": [
{
"url": "https://www.brainz.co.kr/Features"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "09832df1-09c1-45b4-8a85-16c601d30feb",
"assignerShortName": "FSI",
"cveId": "CVE-2026-88260",
"datePublished": "2026-09-11T02:29:52.162Z",
"dateReserved": "2026-09-10T00:46:49.862Z",
"dateUpdated": "2026-09-11T16:53:14.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86084 (GCVE-0-2026-86084)
Vulnerability from cvelistv5 – Published: 2026-09-08 21:21 – Updated: 2026-09-09 13:50
VLAI
EPSS
VEX
Title
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
Summary
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 13:49 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | x_refsource_CONFIRM |
| https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 | x_refsource_MISC |
| https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 | x_refsource_MISC |
| https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86084",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T13:49:33.721879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:50:25.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.38.0, \u003c 2.38.2"
},
{
"status": "affected",
"version": "\u003e= 2.0.0, \u003c 2.37.7"
},
{
"status": "affected",
"version": "\u003c 1.123.76"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T21:21:55.410Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37"
},
{
"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76"
},
{
"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7"
},
{
"name": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2"
}
],
"source": {
"advisory": "GHSA-pf83-w3f9-8m37",
"discovery": "UNKNOWN"
},
"title": "n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86084",
"datePublished": "2026-09-08T21:21:55.410Z",
"dateReserved": "2026-09-04T19:34:03.101Z",
"dateUpdated": "2026-09-09T13:50:25.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.