Monthly
Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.
phpSysInfo up to and including version 3.4.5 exposes a complete IP allowlist bypass in read_config.php that any unauthenticated remote attacker can exploit by sending a spoofed X-Forwarded-For or Client-IP HTTP header set to any address present in the PSI_ALLOWED configuration. The flaw (CWE-290) renders the application's only access-control mechanism entirely ineffective, allowing full retrieval of system telemetry including hostname, kernel version, CPU model, memory layout, filesystems, and network interface addresses. A working proof-of-concept is publicly available on Exploit-DB; no CISA KEV listing exists at time of analysis.
Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified; however, the low complexity and zero-privilege requirement make opportunistic abuse plausible.
Reactor Netty HTTP Server incorrectly evaluates the remote client IP address in deployments where HAProxy PROXY Protocol support is enabled, potentially allowing network attackers to spoof their apparent source IP. Affected versions span the 1.0.x, 1.1.x/1.2.x, and 1.3.x branches. This flaw carries no confidentiality or availability impact per the CVSS vector, but can undermine IP-based access controls, rate limiting, audit logging, or allowlist/denylist enforcement that rely on the server's perception of the client IP. No public exploit code or CISA KEV listing is present at time of analysis.
Complete authentication bypass in TarsWeb (the web console for the TARS microservice framework) through 3.0.14 lets a remote unauthenticated attacker act as any account, including an administrator, by sending a forged X-Forwarded-For header naming the loopback address together with a uid query parameter. Because app.js trusts Koa's proxy option blindly and the SSO middleware treats the loopback allowlist match as authorization to adopt the caller-supplied uid, no ticket, cookie, or password is ever checked. No public exploit is identified at the time of analysis, but the technique is trivial and the CVSS 4.0 base score is 9.3 (Critical).
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.
Authentication bypass in LACT (Linux AMD GPU Configuration Tool) through version 0.10.0 allows a local attacker with low privileges to circumvent Polkit-based access controls by exploiting PID reuse in the UnixProcessSubject / Peer PID authentication mechanism (CWE-290). By winning a race condition between Polkit's process identity check and authorization grant, an attacker can spoof their process as a legitimately authorized caller and gain unauthorized control over privileged GPU configuration operations. No public exploit code has been identified and no active exploitation has been confirmed at time of analysis.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.
Authentication bypass in OAuth2 Proxy (versions 7.5.0 up to but excluding 7.15.2) lets an unauthenticated remote attacker reach protected upstream routes by spoofing the X-Forwarded-Uri header. Because the trusted-proxy IP set defaults to 0.0.0.0/0 (and ::/0) whenever --reverse-proxy is enabled without --trusted-proxy-ip, every client is treated as a trusted proxy, so the skip-auth allow list is matched against the attacker-controlled header value while the real protected path is passed to the upstream. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-7x63-xv5r-3p2x); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.
phpSysInfo up to and including version 3.4.5 exposes a complete IP allowlist bypass in read_config.php that any unauthenticated remote attacker can exploit by sending a spoofed X-Forwarded-For or Client-IP HTTP header set to any address present in the PSI_ALLOWED configuration. The flaw (CWE-290) renders the application's only access-control mechanism entirely ineffective, allowing full retrieval of system telemetry including hostname, kernel version, CPU model, memory layout, filesystems, and network interface addresses. A working proof-of-concept is publicly available on Exploit-DB; no CISA KEV listing exists at time of analysis.
Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified; however, the low complexity and zero-privilege requirement make opportunistic abuse plausible.
Reactor Netty HTTP Server incorrectly evaluates the remote client IP address in deployments where HAProxy PROXY Protocol support is enabled, potentially allowing network attackers to spoof their apparent source IP. Affected versions span the 1.0.x, 1.1.x/1.2.x, and 1.3.x branches. This flaw carries no confidentiality or availability impact per the CVSS vector, but can undermine IP-based access controls, rate limiting, audit logging, or allowlist/denylist enforcement that rely on the server's perception of the client IP. No public exploit code or CISA KEV listing is present at time of analysis.
Complete authentication bypass in TarsWeb (the web console for the TARS microservice framework) through 3.0.14 lets a remote unauthenticated attacker act as any account, including an administrator, by sending a forged X-Forwarded-For header naming the loopback address together with a uid query parameter. Because app.js trusts Koa's proxy option blindly and the SSO middleware treats the loopback allowlist match as authorization to adopt the caller-supplied uid, no ticket, cookie, or password is ever checked. No public exploit is identified at the time of analysis, but the technique is trivial and the CVSS 4.0 base score is 9.3 (Critical).
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.
Authentication bypass in LACT (Linux AMD GPU Configuration Tool) through version 0.10.0 allows a local attacker with low privileges to circumvent Polkit-based access controls by exploiting PID reuse in the UnixProcessSubject / Peer PID authentication mechanism (CWE-290). By winning a race condition between Polkit's process identity check and authorization grant, an attacker can spoof their process as a legitimately authorized caller and gain unauthorized control over privileged GPU configuration operations. No public exploit code has been identified and no active exploitation has been confirmed at time of analysis.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.
Authentication bypass in OAuth2 Proxy (versions 7.5.0 up to but excluding 7.15.2) lets an unauthenticated remote attacker reach protected upstream routes by spoofing the X-Forwarded-Uri header. Because the trusted-proxy IP set defaults to 0.0.0.0/0 (and ::/0) whenever --reverse-proxy is enabled without --trusted-proxy-ip, every client is treated as a trusted proxy, so the skip-auth allow list is matched against the attacker-controlled header value while the real protected path is passed to the upstream. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-7x63-xv5r-3p2x); no public exploit identified at time of analysis, and it is not listed in CISA KEV.