Common Weakness Enumeration
CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
6909 vulnerabilities reference this CWE, most recent first.
CVE-2026-109372 (GCVE-0-2026-109372)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:05 – Updated: 2026-10-12 16:05
VLAI
EPSS
VEX
Title
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
Summary
ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations.
Severity
8.7 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/zitadel/zitadel/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/zitadel-3.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-28 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zitadel",
"vendor": "zitadel",
"versions": [
{
"lessThan": "4.19.2",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.2",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "livio-a"
},
{
"lang": "en",
"type": "finder",
"value": "IAM-marco"
},
{
"lang": "en",
"type": "reporter",
"value": "everping"
},
{
"lang": "en",
"type": "reporter",
"value": "AdamKorcz"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers with organization-administrator permission can register a SAML provider with their own signing key to obtain authenticated sessions as any user linked to another SAML provider on the instance, including in other organizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:05:44.977Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x4c7-fpcx-w9q6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-x4c7-fpcx-w9q6"
},
{
"name": "VulnCheck Advisory: ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zitadel-3.0.0-before-4.19.2-account-takeover-via-saml-identity-provider-confusion"
}
],
"title": "ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109372",
"datePublished": "2026-10-12T16:05:44.977Z",
"dateReserved": "2026-10-12T14:23:25.691Z",
"dateUpdated": "2026-10-12T16:05:44.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109313 (GCVE-0-2026-109313)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:05 – Updated: 2026-10-12 16:05
VLAI
EPSS
VEX
Title
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
Summary
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.
Severity
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisorythird-party-advisory |
| https://www.vulncheck.com/advisories/grav-login-p… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getgrav | grav-plugin-login |
Affected:
2.7.0 , < 3.9.9
(semver)
Unaffected: 3.9.9 (semver) |
Date Public
2026-09-23 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "grav-plugin-login",
"repo": "https://github.com/getgrav/grav-plugin-login",
"vendor": "getgrav",
"versions": [
{
"lessThan": "3.9.9",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.9.9",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "redwolf1919"
}
],
"datePublic": "2026-09-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:05:08.299Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cmg5-qw8p-gxcf)",
"tags": [
"vendor-advisory",
"third-party-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-cmg5-qw8p-gxcf"
},
{
"name": "VulnCheck Advisory: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-login-plugin-2.7.0-before-3.9.9-2fa-bypass-via-remember-me-cookie"
}
],
"title": "Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109313",
"datePublished": "2026-10-12T16:05:08.299Z",
"dateReserved": "2026-10-12T14:14:27.021Z",
"dateUpdated": "2026-10-12T16:05:08.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109312 (GCVE-0-2026-109312)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:05 – Updated: 2026-10-12 16:05
VLAI
EPSS
VEX
Title
Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
Summary
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.
Severity
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisorythird-party-advisory |
| https://www.vulncheck.com/advisories/grav-login-p… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getgrav | grav-plugin-login |
Affected:
2.7.0 , < 3.9.9
(semver)
Unaffected: 3.9.9 (semver) |
Date Public
2026-09-23 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "grav-plugin-login",
"repo": "https://github.com/getgrav/grav-plugin-login",
"vendor": "getgrav",
"versions": [
{
"lessThan": "3.9.9",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.9.9",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "redwolf1919"
}
],
"datePublic": "2026-09-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim\u0027s password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:05:07.605Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5rph-jqcf-2x36)",
"tags": [
"vendor-advisory",
"third-party-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-5rph-jqcf-2x36"
},
{
"name": "VulnCheck Advisory: Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-login-plugin-2.7.0-before-3.9.9-2fa-bypass-via-profile-update-form"
}
],
"title": "Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109312",
"datePublished": "2026-10-12T16:05:07.605Z",
"dateReserved": "2026-10-12T14:14:27.021Z",
"dateUpdated": "2026-10-12T16:05:07.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109082 (GCVE-0-2026-109082)
Vulnerability from cvelistv5 – Published: 2026-10-12 06:18 – Updated: 2026-10-12 07:12
VLAI
EPSS
VEX
Title
Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients
Summary
A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret.
Severity
6.8 (Medium)
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-109082 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2549478 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
Date Public
2026-10-09 18:42
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "keycloak-services",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank MZOUGHI Mohamed Amine (zerOiQ) for reporting this issue."
}
],
"datePublic": "2026-10-09T18:42:43.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows where a client initiates a login on behalf of a user. The issue occurs because Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could use this flaw to trick a user into approving a login request, eventually gaining full access to the users account without needing a client secret."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T07:12:27.872Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-109082"
},
{
"name": "RHBZ#2549478",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549478"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T18:42:43.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-09T18:42:43.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-287: Improper Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-109082",
"datePublished": "2026-10-12T06:18:08.096Z",
"dateReserved": "2026-10-12T06:09:06.647Z",
"dateUpdated": "2026-10-12T07:12:27.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108921 (GCVE-0-2026-108921)
Vulnerability from cvelistv5 – Published: 2026-10-12 18:45 – Updated: 2026-10-12 18:45
VLAI
EPSS
VEX
Title
KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication
Summary
A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416734 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416734/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108921 | third-party-advisory |
| https://vuldb.com/submit/994370 | third-party-advisory |
| https://github.com/KusalkaSilva/Learning-Manageme… | exploitissue-tracking |
| https://github.com/KusalkaSilva/Learning-Manageme… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| KusalkaSilva | Learning-Management-System |
Affected:
ffeb873f8803f1e9664384ff75000c7da45466d2
cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kusalkasilva:learning-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"State-Changing Endpoints"
],
"product": "Learning-Management-System",
"vendor": "KusalkaSilva",
"versions": [
{
"status": "affected",
"version": "ffeb873f8803f1e9664384ff75000c7da45466d2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "vuldb2026 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysql_query of the file remove_announcements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T18:45:15.546Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416734 | KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416734"
},
{
"name": "VDB-416734 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416734/cti"
},
{
"name": "CVE-2026-108921 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108921"
},
{
"name": "Submit #994370 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/994370"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/issues/5"
},
{
"tags": [
"product"
],
"url": "https://github.com/KusalkaSilva/Learning-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T19:35:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108921",
"datePublished": "2026-10-12T18:45:15.546Z",
"dateReserved": "2026-10-11T17:30:13.900Z",
"dateUpdated": "2026-10-12T18:45:15.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108907 (GCVE-0-2026-108907)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:15 – Updated: 2026-10-12 16:15
VLAI
EPSS
VEX
Title
Netcore NR268 CGI Execution user_ok improper authentication
Summary
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416702 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416702/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108907 | third-party-advisory |
| https://vuldb.com/submit/977173 | third-party-advisory |
| https://github.com/draw-ctf/report/blob/main/NR26… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:netcore:nr268:*:*:*:*:*:*:*:*"
],
"modules": [
"CGI Execution"
],
"product": "NR268",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.7.121109"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nebula (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:15:10.558Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416702 | Netcore NR268 CGI Execution user_ok improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416702"
},
{
"name": "VDB-416702 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416702/cti"
},
{
"name": "CVE-2026-108907 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108907"
},
{
"name": "Submit #977173 | Netcore NR268 Router NR268-V1.7.121109.bin Improper Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/977173"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/draw-ctf/report/blob/main/NR268/2026.09.14-netcore-nr268-boa-auth-fail-open.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T17:00:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "Netcore NR268 CGI Execution user_ok improper authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108907",
"datePublished": "2026-10-12T16:15:10.558Z",
"dateReserved": "2026-10-11T14:55:14.375Z",
"dateUpdated": "2026-10-12T16:15:10.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108865 (GCVE-0-2026-108865)
Vulnerability from cvelistv5 – Published: 2026-10-11 13:26 – Updated: 2026-10-11 13:26
VLAI
EPSS
VEX
Title
AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize
Summary
AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.
Severity
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/amoylab… | third-party-advisory |
| https://github.com/AmoyLab/Unla/blob/v0.10.0/inte… | technical-description |
| https://github.com/AmoyLab/Unla/blob/v0.10.0/inte… | technical-description |
| https://github.com/AmoyLab/Unla | product |
| https://www.vulncheck.com/advisories/amoylab-unla… | third-party-advisory |
Date Public
2026-10-11 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/amoylab/unla",
"product": "Unla",
"repo": "https://github.com/AmoyLab/Unla",
"vendor": "AmoyLab",
"versions": [
{
"lessThanOrEqual": "0.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T13:26:10.714Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/amoylab-unla-oauth-self-issued-token-authz"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/auth/oauth.go#L86-L147"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/core/server.go#L229-L261"
},
{
"tags": [
"product"
],
"url": "https://github.com/AmoyLab/Unla"
},
{
"name": "VulnCheck Advisory: AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/amoylab-unla-through-0.10.0-oauth2-authentication-bypass-via-authorize"
}
],
"title": "AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108865",
"datePublished": "2026-10-11T13:26:10.714Z",
"dateReserved": "2026-10-11T13:17:24.455Z",
"dateUpdated": "2026-10-11T13:26:10.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108818 (GCVE-0-2026-108818)
Vulnerability from cvelistv5 – Published: 2026-10-12 09:00 – Updated: 2026-10-12 09:00
VLAI
EPSS
VEX
Title
agno-agi agno auth.py get_authentication_dependency missing authentication
Summary
A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the argument security_key leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416595 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416595/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108818 | third-party-advisory |
| https://vuldb.com/submit/964162 | third-party-advisory |
| https://vuldb.com/submit/964163 | third-party-advisory |
| https://github.com/Agno-agi/Agno/issues/10051 | issue-tracking |
| https://github.com/ybyu-ieu/agno-security-advisor… | exploit |
| https://github.com/Agno-agi/Agno/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:agno-agi:agno:*:*:*:*:*:*:*:*"
],
"product": "agno",
"vendor": "agno-agi",
"versions": [
{
"status": "affected",
"version": "2.7.0"
},
{
"status": "affected",
"version": "2.7.1"
},
{
"status": "affected",
"version": "2.7.2"
},
{
"status": "affected",
"version": "2.7.3"
},
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.0.1"
},
{
"status": "affected",
"version": "3.0.2"
},
{
"status": "affected",
"version": "3.0.3"
},
{
"status": "affected",
"version": "3.0.4"
},
{
"status": "affected",
"version": "3.0.5"
},
{
"status": "affected",
"version": "3.0.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ybyu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the argument security_key leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T09:00:18.482Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416595 | agno-agi agno auth.py get_authentication_dependency missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416595"
},
{
"name": "VDB-416595 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416595/cti"
},
{
"name": "CVE-2026-108818 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108818"
},
{
"name": "Submit #964162 | Agno AGI Agno 2.7.3 CWE-306 Missing Authentication for Critical Function",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/964162"
},
{
"name": "Submit #964163 | Agno AGI Agno 2.7.3 CWE-306 Missing Authentication (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/964163"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Agno-agi/Agno/issues/10051"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-agentos-no-authentication-by-default.md"
},
{
"tags": [
"product"
],
"url": "https://github.com/Agno-agi/Agno/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T12:46:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "agno-agi agno auth.py get_authentication_dependency missing authentication",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108818",
"datePublished": "2026-10-12T09:00:18.482Z",
"dateReserved": "2026-10-11T10:41:41.368Z",
"dateUpdated": "2026-10-12T09:00:18.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108707 (GCVE-0-2026-108707)
Vulnerability from cvelistv5 – Published: 2026-10-11 01:12 – Updated: 2026-10-11 01:12
VLAI
EPSS
VEX
Title
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
Summary
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
Severity
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/AnkesKasty/cve-request-poc/blo… | exploit |
| https://github.com/AnkesKasty/cve-request-poc/blo… | exploit |
| https://github.com/AnkesKasty/cve-request-poc/blo… | exploit |
| https://github.com/WuKongOpenSource/Wukong_HRM/bl… | technical-description |
| https://github.com/WuKongOpenSource/Wukong_HRM/bl… | technical-description |
| https://www.vulncheck.com/advisories/wukong-hrm-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WuKongOpenSource | Wukong_HRM |
Affected:
0 , ≤ 186115e1a5a0b827ad9596ff8c2f3a876fb0cc55
(git)
|
Date Public
2026-10-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/WuKongOpenSource/Wukong_HRM",
"product": "Wukong_HRM",
"repo": "https://github.com/WuKongOpenSource/Wukong_HRM",
"vendor": "WuKongOpenSource",
"versions": [
{
"lessThanOrEqual": "186115e1a5a0b827ad9596ff8c2f3a876fb0cc55",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yaqi Chao"
}
],
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T01:12:31.801Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Proof of Concept (payslip read)",
"tags": [
"exploit"
],
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_salary_slip_detail_read.py"
},
{
"name": "Researcher Proof of Concept (employee export)",
"tags": [
"exploit"
],
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_employee_export_pii.py"
},
{
"name": "Researcher Proof of Concept (attachment download)",
"tags": [
"exploit"
],
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/Wukong_HRM/poc_attachment_download_idor.py"
},
{
"name": "Vulnerable Code: ParamAspect (commit 186115e)",
"tags": [
"technical-description"
],
"url": "https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/common/common-web/src/main/java/com/kakarote/core/config/ParamAspect.java#L35-L55"
},
{
"name": "Vulnerable Code: EmployeeAspect (commit 186115e)",
"tags": [
"technical-description"
],
"url": "https://github.com/WuKongOpenSource/Wukong_HRM/blob/186115e1a5a0b827ad9596ff8c2f3a876fb0cc55/hrm/hrm-web/src/main/java/com/kakarote/hrm/common/EmployeeAspect.java#L28-L45"
},
{
"name": "VulnCheck Advisory: Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wukong-hrm-through-commit-186115e-authentication-bypass-via-paramaspect"
}
],
"title": "Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108707",
"datePublished": "2026-10-11T01:12:31.801Z",
"dateReserved": "2026-10-10T23:51:26.941Z",
"dateUpdated": "2026-10-11T01:12:31.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108548 (GCVE-0-2026-108548)
Vulnerability from cvelistv5 – Published: 2026-10-10 14:35 – Updated: 2026-10-10 14:35
VLAI
EPSS
VEX
Title
AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token
Summary
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
Severity
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/iflytek/astron-rpa/issues/886 | issue-tracking |
| https://github.com/iflytek/astron-rpa | product |
| https://github.com/iflytek/astron-rpa/blob/v1.1.6… | technical-description |
| https://github.com/iflytek/astron-rpa/blob/v1.1.6… | technical-description |
| https://www.vulncheck.com/advisories/astronrpa-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iflytek | astron-rpa |
Affected:
0 , ≤ 1.1.6
(semver)
|
Date Public
2026-10-06 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "astron-rpa",
"vendor": "iflytek",
"versions": [
{
"lessThanOrEqual": "1.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway\u0027s auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T14:35:03.690Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #886",
"tags": [
"issue-tracking"
],
"url": "https://github.com/iflytek/astron-rpa/issues/886"
},
{
"tags": [
"product"
],
"url": "https://github.com/iflytek/astron-rpa"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/iflytek/astron-rpa/blob/v1.1.6/docker/volumes/nginx/lua/auth_handler.lua#L21-L35"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/iflytek/astron-rpa/blob/v1.1.6/backend/ai-service/app/dependencies/__init__.py#L10-L24"
},
{
"name": "VulnCheck Advisory: AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/astronrpa-through-1.1.6-authentication-bypass-via-arbitrary-bearer-token"
}
],
"title": "AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108548",
"datePublished": "2026-10-10T14:35:03.690Z",
"dateReserved": "2026-10-10T14:24:42.459Z",
"dateUpdated": "2026-10-10T14:35:03.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.