Monthly
Authentication bypass in Apache Tomcat's JNDI realm allows unauthenticated remote attackers to log in without a valid password when the realm is configured with a non-GSSAPI SASL mechanism. The flaw affects 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122, plus EOL 8.5.x and 7.0.x branches, and Apache has released fixes in 11.0.27, 10.1.61, and 9.0.123. No public exploit has been identified at time of analysis, and exploitation requires the non-default JNDIRealm/non-GSSAPI SASL configuration.
Authentication bypass in Progress MOVEit Transfer's LDAP module allows unauthenticated remote attackers to skip a critical authentication step, carrying CVSS 9.8 impact on confidentiality, integrity, and availability when LDAP external authentication is enabled and the web interface is network-reachable. Affected releases are before 2025.1.6 and 2026.0.0 before 2026.0.4; fixed builds are 2025.1.6 and 2026.0.4. Exploitation signals conflict sharply: despite the critical score, no public exploit has been identified at time of analysis, EPSS is 0.46% (38th percentile), and CISA SSVC lists exploitation as 'none' while assigning total technical impact.
Second-factor authentication bypass in TSplus Remote Access lets an attacker who already holds a valid username and password complete the login without ever supplying a valid MFA token, granting access to the protected applications and resources that MFA was meant to guard. The flaw is authenticated (PR:L) and remotely reachable over the network (AV:N) with no user interaction required, and it carries high confidentiality, integrity, and availability impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 8.7). No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); however, because the defect neutralises a control that many operators rely on as their primary protection for a remote-access gateway, it warrants priority remediation regardless of the absence of exploitation telemetry.
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD allows unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to pass password authentication checks when an SSH server is configured to use LdapPasswordAuthenticator, yielding high confidentiality and integrity impact (rated 9.1 critical). Affected builds are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5; servers that rely on sshd-core's built-in password mechanisms, or that do not use sshd-ldap at all, are not affected. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing), but real-world exposure is sharply limited by the non-default optional component and the explicit LDAP authenticator configuration required - the raw 9.1 score is driven by impact rather than by a broad exploitable population.
A partial authentication bypass in Apache MINA SSHD lets a remote attacker satisfy a repeated-public-key multi-authentication policy by presenting the same public key twice, so a server configured to demand two distinct keys can be entered with only one of them. Affected are versions before 2.20.0 and 3.0.0-M1 through 3.0.0-M5 of the sshd-core component; the vendor assigns CVSS 3.1 8.1 (High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), where PR:L reflects that the attacker must already legitimately possess at least one accepted key pair. Exploitation is confined to the non-default hardened configuration that requires repeated/multiple public keys (the equivalent of OpenSSH's AuthenticationMethods "publickey,publickey"); single-key or password-based deployments are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
Two-factor authentication bypass in phpMyFAQ before 4.1.7 allows any attacker holding valid first-factor credentials to obtain a remember-me cookie prior to 2FA challenge completion, then replay that cookie to achieve full authenticated access while entirely circumventing the second-factor control. Affected deployments relying on 2FA as their primary defense-in-depth layer against credential compromise are effectively left with single-factor authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass logic is straightforward and the vulnerability is trivially reproducible given valid credentials.
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client to self-assign privileged scopes by supplying arbitrary `scope` values in the registration request, which the authorization server stores verbatim without validating against a server-defined allowlist. Affected versions span the 3.x, 4.1.x, and 4.2.x release lines; patched releases 3.6.12, 4.1.8, and 4.2.3 are available per the Apache advisory. No public exploit or active exploitation has been identified at time of analysis, but the straightforward exploitation path - crafting a single registration request - makes this a meaningful authorization bypass risk for any deployment exposing CXF's OAuth2 AS with Dynamic Client Registration enabled.
Privilege escalation in the Serendipity (s9y) PHP blogging platform before 2.6.1 lets an authenticated Editor take over an Administrator account by exploiting an authentication context confusion (CWE-304): password checking and session loading resolve the user independently rather than binding to a single record. By registering a username that collides with an Administrator's, the Editor logs in with their own password yet has the Administrator's account loaded into their session, inheriting full admin rights. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact.
Authentication bypass in Apache Tomcat (7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.100, 10.1.0-M1-10.1.36, 11.0.0-M1-11.0.4) lets remote attackers authenticate without supplying the correct password when the JNDIRealm is configured to validate credentials via GSSAPI bind. The flaw (CWE-304, Missing Critical Step in Authentication) means the realm accepts a bind as successful even when the password verification step is effectively skipped. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 12th percentile), and it is not listed in CISA KEV.
Authentication bypass in Apache Tomcat's JNDI realm allows unauthenticated remote attackers to log in without a valid password when the realm is configured with a non-GSSAPI SASL mechanism. The flaw affects 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122, plus EOL 8.5.x and 7.0.x branches, and Apache has released fixes in 11.0.27, 10.1.61, and 9.0.123. No public exploit has been identified at time of analysis, and exploitation requires the non-default JNDIRealm/non-GSSAPI SASL configuration.
Authentication bypass in Progress MOVEit Transfer's LDAP module allows unauthenticated remote attackers to skip a critical authentication step, carrying CVSS 9.8 impact on confidentiality, integrity, and availability when LDAP external authentication is enabled and the web interface is network-reachable. Affected releases are before 2025.1.6 and 2026.0.0 before 2026.0.4; fixed builds are 2025.1.6 and 2026.0.4. Exploitation signals conflict sharply: despite the critical score, no public exploit has been identified at time of analysis, EPSS is 0.46% (38th percentile), and CISA SSVC lists exploitation as 'none' while assigning total technical impact.
Second-factor authentication bypass in TSplus Remote Access lets an attacker who already holds a valid username and password complete the login without ever supplying a valid MFA token, granting access to the protected applications and resources that MFA was meant to guard. The flaw is authenticated (PR:L) and remotely reachable over the network (AV:N) with no user interaction required, and it carries high confidentiality, integrity, and availability impact (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 8.7). No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV); however, because the defect neutralises a control that many operators rely on as their primary protection for a remote-access gateway, it warrants priority remediation regardless of the absence of exploitation telemetry.
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD allows unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to pass password authentication checks when an SSH server is configured to use LdapPasswordAuthenticator, yielding high confidentiality and integrity impact (rated 9.1 critical). Affected builds are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5; servers that rely on sshd-core's built-in password mechanisms, or that do not use sshd-ldap at all, are not affected. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing), but real-world exposure is sharply limited by the non-default optional component and the explicit LDAP authenticator configuration required - the raw 9.1 score is driven by impact rather than by a broad exploitable population.
A partial authentication bypass in Apache MINA SSHD lets a remote attacker satisfy a repeated-public-key multi-authentication policy by presenting the same public key twice, so a server configured to demand two distinct keys can be entered with only one of them. Affected are versions before 2.20.0 and 3.0.0-M1 through 3.0.0-M5 of the sshd-core component; the vendor assigns CVSS 3.1 8.1 (High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), where PR:L reflects that the attacker must already legitimately possess at least one accepted key pair. Exploitation is confined to the non-default hardened configuration that requires repeated/multiple public keys (the equivalent of OpenSSH's AuthenticationMethods "publickey,publickey"); single-key or password-based deployments are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
Two-factor authentication bypass in phpMyFAQ before 4.1.7 allows any attacker holding valid first-factor credentials to obtain a remember-me cookie prior to 2FA challenge completion, then replay that cookie to achieve full authenticated access while entirely circumventing the second-factor control. Affected deployments relying on 2FA as their primary defense-in-depth layer against credential compromise are effectively left with single-factor authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass logic is straightforward and the vulnerability is trivially reproducible given valid credentials.
Authorization scope escalation in Apache CXF's OAuth2 Dynamic Client Registration endpoint allows any registering client to self-assign privileged scopes by supplying arbitrary `scope` values in the registration request, which the authorization server stores verbatim without validating against a server-defined allowlist. Affected versions span the 3.x, 4.1.x, and 4.2.x release lines; patched releases 3.6.12, 4.1.8, and 4.2.3 are available per the Apache advisory. No public exploit or active exploitation has been identified at time of analysis, but the straightforward exploitation path - crafting a single registration request - makes this a meaningful authorization bypass risk for any deployment exposing CXF's OAuth2 AS with Dynamic Client Registration enabled.
Privilege escalation in the Serendipity (s9y) PHP blogging platform before 2.6.1 lets an authenticated Editor take over an Administrator account by exploiting an authentication context confusion (CWE-304): password checking and session loading resolve the user independently rather than binding to a single record. By registering a username that collides with an Administrator's, the Editor logs in with their own password yet has the Administrator's account loaded into their session, inheriting full admin rights. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact.
Authentication bypass in Apache Tomcat (7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.100, 10.1.0-M1-10.1.36, 11.0.0-M1-11.0.4) lets remote attackers authenticate without supplying the correct password when the JNDIRealm is configured to validate credentials via GSSAPI bind. The flaw (CWE-304, Missing Critical Step in Authentication) means the realm accepts a bind as successful even when the password verification step is effectively skipped. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 12th percentile), and it is not listed in CISA KEV.