CWE-291

Reliance on IP Address for Authentication

5 CVEs Avg CVSS 8.7 MITRE
1
CRITICAL
3
HIGH
0
MEDIUM
0
LOW
2
POC
0
KEV

Monthly

CVE-2026-3690 HIGH This Week

Unauthenticated remote attackers bypass authentication in OpenClaw canvas endpoints due to improper authentication implementation (CWE-291). Exploitation requires no user interaction and yields high confidentiality/integrity impact. Network-accessible attack vector with high complexity (CVSS:3.0 7.4 AV:N/AC:H/PR:N). No public exploit identified at time of analysis. Originally reported as ZDI-CAN-29311.

Authentication Bypass
NVD GitHub VulDB
CVSS 3.0
7.4
EPSS
0.1%
CVE-2026-4252 HIGH POC This Week

A critical authentication bypass vulnerability exists in Tenda AC8 router firmware version 16.03.50.11 where the IPv6 handler function check_is_ipv6 relies on IP address for authentication, allowing remote attackers to gain unauthorized access. The vulnerability has a publicly available proof-of-concept exploit on GitHub and scores 9.8 CVSS, enabling complete compromise of the affected device with no authentication required. While not currently listed in CISA KEV, the combination of public exploit availability and ease of exploitation makes this a high-priority vulnerability for organizations using affected Tenda routers.

Tenda Information Disclosure
NVD VulDB GitHub
CVSS 4.0
8.9
EPSS
0.1%
CVE-2025-66602 CRITICAL Act Now

Yokogawa FAST/TOOLS SCADA has a vulnerability in its web server component enabling unauthorized access to the industrial control monitoring system.

Information Disclosure
NVD
CVSS 3.1
9.8
EPSS
0.1%
CVE-2025-59101 Monitor

Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated.

Information Disclosure
NVD
EPSS
0.0%
CVE-2025-34202 HIGH POC This Week

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an. Rated high severity (CVSS 8.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Docker RCE Redis Virtual Appliance Application Virtual Appliance Host
NVD
CVSS 4.0
8.7
EPSS
0.4%
CVE-2026-3690
EPSS 0% CVSS 7.4
HIGH This Week

Unauthenticated remote attackers bypass authentication in OpenClaw canvas endpoints due to improper authentication implementation (CWE-291). Exploitation requires no user interaction and yields high confidentiality/integrity impact. Network-accessible attack vector with high complexity (CVSS:3.0 7.4 AV:N/AC:H/PR:N). No public exploit identified at time of analysis. Originally reported as ZDI-CAN-29311.

Authentication Bypass
NVD GitHub VulDB
CVE-2026-4252
EPSS 0% CVSS 8.9
HIGH POC This Week

A critical authentication bypass vulnerability exists in Tenda AC8 router firmware version 16.03.50.11 where the IPv6 handler function check_is_ipv6 relies on IP address for authentication, allowing remote attackers to gain unauthorized access. The vulnerability has a publicly available proof-of-concept exploit on GitHub and scores 9.8 CVSS, enabling complete compromise of the affected device with no authentication required. While not currently listed in CISA KEV, the combination of public exploit availability and ease of exploitation makes this a high-priority vulnerability for organizations using affected Tenda routers.

Tenda Information Disclosure
NVD VulDB GitHub
CVE-2025-66602
EPSS 0% CVSS 9.8
CRITICAL Act Now

Yokogawa FAST/TOOLS SCADA has a vulnerability in its web server component enabling unauthorized access to the industrial control monitoring system.

Information Disclosure
NVD
CVE-2025-59101
EPSS 0%
Monitor

Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated.

Information Disclosure
NVD
CVE-2025-34202
EPSS 0% CVSS 8.7
HIGH POC This Week

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an. Rated high severity (CVSS 8.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Docker RCE Redis +2
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy