Monthly
An authentication bypass in Apache Qpid Proton C through 0.40.0 lets a remote peer step past SASL authentication by sending AMQP performatives that claim to be SASL frames, which the vendor rates as important severity. Impact is conditional rather than automatic: the bypass leaves no user name set, so authentication has not actually completed, and the real outcome depends on whether the hosting application tolerates an identity-less session or falls back to a default identity. No public exploit code or active exploitation was identified at time of analysis, and the vendor has published 0.41.1 as the fixed release tracked under PROTON-2945.
Unauthenticated attackers can bypass authentication on BMC Helix Network Management on-prem deployments (versions before 26.3.01) when SAML single sign-on is configured, logging in as the local administrator with any password to obtain a SuperAdmin session. This flaw allows modification of device credentials, execution of device commands, and alteration of audit records. No public exploit code has been identified at time of analysis, but the vulnerability is remotely exploitable without authentication and requires only that the SAML SSO feature be enabled.
Authentication bypass in Gitea's built-in SSH server (affected releases up to and including 1.27.3) lets a remote attacker authenticate as another user by presenting a case-variant of that user's registered RSA public key. Three conditions must all hold: the built-in SSH server must be enabled via START_SSH_SERVER = true (non-default on many deployments), the backing database must perform case-insensitive text comparison (the default SQLite qualifies), and the attacker must possess or derive a working RSA private key whose public key differs from the victim's only by letter case, which is cryptographically very hard and is why the effort is assessed as high complexity rather than the low complexity of the published vendor vector. No public exploit code identified at time of analysis; EPSS is 0.16% (4th percentile) and the CISA SSVC assessment records exploitation: none. The flaw is fixed in v28.0.0 by matching keys on their SHA256 fingerprint instead of encoded content.
An authentication bypass in Apache MINA SSHD's sshd-core library (versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) allows remote, unauthenticated attackers to skip signature verification during public-key or hostbased SSH authentication, potentially granting an attacker a valid session. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 critical) reflects high confidentiality and integrity impact, but exploitation is gated by a non-default precondition: the server operator must have written explicit custom code enabling the library's 'asynchronous authentication' mechanism and applied it to public-key or hostbased authentication. Apache rates this implementation choice as presumed rare, and servers that do not opt into asynchronous authentication - or that use it only with password or keyboard-interactive auth - are not exposed. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing).
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandatory email-confirmation gate configured through the password strategy's require_confirmed_with option. The check in AshAuthentication.Strategy.Password.Actions.check_user/2 compares the confirmation attribute against nil with a bare is_nil(Map.get(user, field)), so Ash's %Ash.NotLoaded{} and %Ash.ForbiddenField{} sentinels - returned when the attribute is not selected on the loaded record or is hidden from the current actor by a field policy - are treated as a confirmed value; the check also exists only inside the strategy's Actions module and is not attached to the sign-in/register action itself, so callers that invoke the action directly, including API layers such as AshGraphql and AshJsonApi in the default configuration, skip it entirely. Unauthenticated per the CVSS 4.0 vector (PR:N, with AT:P indicating the target must actually have require_confirmed_with configured), CVSS 9.1, CWE-305 (Authentication Bypass by Primary Weakness); no public exploit identified at time of analysis, and vendor patches are available in 4.15.0 and 5.0.0-rc.14.
Authentication bypass in N-able N-central before version 2026.3 HF 3 permits low-privileged authenticated users to access internal-only APIs without proper authorization checks, achieving effective privilege escalation within the platform. N-central is a remote monitoring and management (RMM) platform used extensively by managed service providers (MSPs) to control customer endpoints, meaning unauthorized API access could cascade to managed devices across multiple customer environments. No public exploit has been identified at time of analysis, but a vendor patch has been released as HF 3.
Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated remote attackers to trigger backend administrative operations before access validation completes, enabling unauthorized modification of system configurations. The CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with high integrity impact, indicating network-exploitable, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though PaperCut products have historically been high-value ransomware targets.
Two-factor authentication bypass in the Perl module Punk::Plugin::TOTP before 0.05 lets an attacker who already knows a victim's password clear the victim's TOTP challenge using a recovery code issued to the attacker's own account. The flaw stems from the recovery-code helper looking up codes by digest across all users and then binding ownership through a numeric comparison of user identifiers, which fails whenever accounts are keyed by username, email, or UUID. No CISA KEV listing and no public exploit identified at time of analysis, with a low EPSS score of 0.44% (37th percentile) despite the 9.8 CVSS rating.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.
An authentication bypass in Apache Qpid Proton C through 0.40.0 lets a remote peer step past SASL authentication by sending AMQP performatives that claim to be SASL frames, which the vendor rates as important severity. Impact is conditional rather than automatic: the bypass leaves no user name set, so authentication has not actually completed, and the real outcome depends on whether the hosting application tolerates an identity-less session or falls back to a default identity. No public exploit code or active exploitation was identified at time of analysis, and the vendor has published 0.41.1 as the fixed release tracked under PROTON-2945.
Unauthenticated attackers can bypass authentication on BMC Helix Network Management on-prem deployments (versions before 26.3.01) when SAML single sign-on is configured, logging in as the local administrator with any password to obtain a SuperAdmin session. This flaw allows modification of device credentials, execution of device commands, and alteration of audit records. No public exploit code has been identified at time of analysis, but the vulnerability is remotely exploitable without authentication and requires only that the SAML SSO feature be enabled.
Authentication bypass in Gitea's built-in SSH server (affected releases up to and including 1.27.3) lets a remote attacker authenticate as another user by presenting a case-variant of that user's registered RSA public key. Three conditions must all hold: the built-in SSH server must be enabled via START_SSH_SERVER = true (non-default on many deployments), the backing database must perform case-insensitive text comparison (the default SQLite qualifies), and the attacker must possess or derive a working RSA private key whose public key differs from the victim's only by letter case, which is cryptographically very hard and is why the effort is assessed as high complexity rather than the low complexity of the published vendor vector. No public exploit code identified at time of analysis; EPSS is 0.16% (4th percentile) and the CISA SSVC assessment records exploitation: none. The flaw is fixed in v28.0.0 by matching keys on their SHA256 fingerprint instead of encoded content.
An authentication bypass in Apache MINA SSHD's sshd-core library (versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) allows remote, unauthenticated attackers to skip signature verification during public-key or hostbased SSH authentication, potentially granting an attacker a valid session. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 critical) reflects high confidentiality and integrity impact, but exploitation is gated by a non-default precondition: the server operator must have written explicit custom code enabling the library's 'asynchronous authentication' mechanism and applied it to public-key or hostbased authentication. Apache rates this implementation choice as presumed rare, and servers that do not opt into asynchronous authentication - or that use it only with password or keyboard-interactive auth - are not exposed. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing).
Unconfirmed accounts can obtain an authenticated session in the AshAuthentication Elixir library, defeating the mandatory email-confirmation gate configured through the password strategy's require_confirmed_with option. The check in AshAuthentication.Strategy.Password.Actions.check_user/2 compares the confirmation attribute against nil with a bare is_nil(Map.get(user, field)), so Ash's %Ash.NotLoaded{} and %Ash.ForbiddenField{} sentinels - returned when the attribute is not selected on the loaded record or is hidden from the current actor by a field policy - are treated as a confirmed value; the check also exists only inside the strategy's Actions module and is not attached to the sign-in/register action itself, so callers that invoke the action directly, including API layers such as AshGraphql and AshJsonApi in the default configuration, skip it entirely. Unauthenticated per the CVSS 4.0 vector (PR:N, with AT:P indicating the target must actually have require_confirmed_with configured), CVSS 9.1, CWE-305 (Authentication Bypass by Primary Weakness); no public exploit identified at time of analysis, and vendor patches are available in 4.15.0 and 5.0.0-rc.14.
Authentication bypass in N-able N-central before version 2026.3 HF 3 permits low-privileged authenticated users to access internal-only APIs without proper authorization checks, achieving effective privilege escalation within the platform. N-central is a remote monitoring and management (RMM) platform used extensively by managed service providers (MSPs) to control customer endpoints, meaning unauthorized API access could cascade to managed devices across multiple customer environments. No public exploit has been identified at time of analysis, but a vendor patch has been released as HF 3.
Improper access control (CWE-305) in the PaperCut MF and PaperCut NG web management interface allows unauthenticated remote attackers to trigger backend administrative operations before access validation completes, enabling unauthorized modification of system configurations. The CVSS 4.0 vector rates this AV:N/AC:L/PR:N/UI:N with high integrity impact, indicating network-exploitable, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, though PaperCut products have historically been high-value ransomware targets.
Two-factor authentication bypass in the Perl module Punk::Plugin::TOTP before 0.05 lets an attacker who already knows a victim's password clear the victim's TOTP challenge using a recovery code issued to the attacker's own account. The flaw stems from the recovery-code helper looking up codes by digest across all users and then binding ownership through a numeric comparison of user identifiers, which fails whenever accounts are keyed by username, email, or UUID. No CISA KEV listing and no public exploit identified at time of analysis, with a low EPSS score of 0.44% (37th percentile) despite the 9.8 CVSS rating.
Bluetooth LE legacy pairing authentication in Silicon Labs RS9116W and SiWx917 wireless modules (WiseConnect SDK) can be bypassed by manipulating the Temporary Key (TK) value during Passkey Entry association, allowing an adjacent unauthenticated attacker to pair with the target device without possessing the correct passkey. Successful exploitation yields high confidentiality and integrity impact on the vulnerable system. The vulnerability is academically documented as B-E3 in a published research paper (arxiv.org/pdf/2409.02905); no public exploit tool or CISA KEV entry has been identified at time of analysis.
Security level downgrade during Bluetooth Low Energy re-pairing in Silicon Labs WiseConnect exposes the Long Term Key (LTK) to practical brute-force attack by an adjacent unauthenticated attacker. Devices running WiseConnect 4.0.0 through 4.0.x and WiseConnect 2.0.0 through 2.13.x accept re-pairing negotiations at weaker security parameters than originally established, reducing LTK entropy and enabling offline key recovery. No public exploit code has been identified at time of analysis, though the vulnerability class is formally documented as V4 in the BLERP academic paper (NDSS); a vendor patch is available in WiseConnect 4.1.0 and 2.14.0.