Monthly
Authentication bypass in the Polish Social Insurance Institution (ZUS) Płatnik desktop client lets an attacker who can run or manipulate a client instance connected to the backend server skip the login verification step and authenticate as an arbitrary user without credentials. The flaw is rooted in client-side authentication (CWE-603), and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - unauthenticated from a privileges standpoint, but gated by local access to a deployed, backend-connected client, which is the main exposure limiter; CERT-PL reports it as EUVD-2026-113776 and the vendor states it is fixed in metric 242 of version 10.02.002. No public exploit code or active exploitation has been identified at time of analysis, and the vuln.today decision label places remediation in this week's patch cycle rather than an emergency response.
Authentication bypass in Hayat Mobile 3.3.x (from 3.3.0 up to but excluding 3.4.0) lets remote, unauthenticated attackers defeat the application's login/trust checks because those decisions are made on the client side, giving access to data that should require a valid session. The vendor/Turkish CERT rates it CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so no credentials or victim interaction are stated as prerequisites, with high confidentiality impact but only low integrity impact and no availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exposure is bounded by the fact that Hayat Mobile is a single healthcare provider's app, and upgrading to 3.4.0 removes the bypass.
Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to perform identity spoofing against other users on the platform. The flaw stems from CWE-603 (Use of Client-Side Authentication), where the server delegates trust to client-controlled data, allowing an authenticated user to forge session identity and corrupt integrity of communications. Three supported server product lines are affected with vendor patches now available; no public exploit or active exploitation has been identified at time of analysis.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Privilege escalation in Sparx Enterprise Architect 17.1 and earlier allows an authenticated low-privilege user to impersonate any other user, including administrators, by tampering with the client-side application (e.g., via a debugger). Because role-based access enforcement happens in the client rather than on the server (CWE-603), an attacker who has any valid login can gain full repository control. No public exploit identified at time of analysis, although technical write-ups are referenced.
Client-side authentication bypass in mpGabinet 23.12.19 and earlier allows local authenticated attackers to impersonate arbitrary users by patching the application binary. An attacker with legitimate low-privilege access to the system can manipulate the compiled application code to skip login verification entirely, gaining unauthorized access as any user including administrators. EPSS score not available for this 2026 CVE; no active exploitation or public POC confirmed at time of analysis.
IAQS and I6 systems by JNC have a client-side enforcement vulnerability allowing unauthenticated attackers to bypass security controls and access server functionality.
Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WebAuthn policy enforcement bypass in Red Hat Build of Keycloak allows low-privileged authenticated users to register credentials that violate administrator-configured realm security policies. The server-side processAction() method does not validate that newly registered WebAuthn credential parameters - such as public key algorithms - conform to the realm's defined WebAuthn policies, enabling a user to manipulate client-side JavaScript during the registration flow to submit non-compliant credential data. No public exploit has been identified at time of analysis; exploitation requires an authenticated session and is limited to integrity impact (policy bypass), with no direct confidentiality or availability consequence.
Authentication bypass in the Polish Social Insurance Institution (ZUS) Płatnik desktop client lets an attacker who can run or manipulate a client instance connected to the backend server skip the login verification step and authenticate as an arbitrary user without credentials. The flaw is rooted in client-side authentication (CWE-603), and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - unauthenticated from a privileges standpoint, but gated by local access to a deployed, backend-connected client, which is the main exposure limiter; CERT-PL reports it as EUVD-2026-113776 and the vendor states it is fixed in metric 242 of version 10.02.002. No public exploit code or active exploitation has been identified at time of analysis, and the vuln.today decision label places remediation in this week's patch cycle rather than an emergency response.
Authentication bypass in Hayat Mobile 3.3.x (from 3.3.0 up to but excluding 3.4.0) lets remote, unauthenticated attackers defeat the application's login/trust checks because those decisions are made on the client side, giving access to data that should require a valid session. The vendor/Turkish CERT rates it CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so no credentials or victim interaction are stated as prerequisites, with high confidentiality impact but only low integrity impact and no availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exposure is bounded by the fact that Hayat Mobile is a single healthcare provider's app, and upgrading to 3.4.0 removes the bypass.
Client-side authentication bypass in Microsoft Skype for Business Server enables a low-privileged network attacker to perform identity spoofing against other users on the platform. The flaw stems from CWE-603 (Use of Client-Side Authentication), where the server delegates trust to client-controlled data, allowing an authenticated user to forge session identity and corrupt integrity of communications. Three supported server product lines are affected with vendor patches now available; no public exploit or active exploitation has been identified at time of analysis.
Unauthorized administrative access in Ebyte NE2-D11 firmware is possible because the device delegates authentication state entirely to the client, performing no meaningful server-side token validation. An unauthenticated remote attacker can replay or forge authentication tokens to elevate access to administrative functionality without valid credentials. Reported via ICS-CERT advisory ICSA-26-237-06, this is an OT/ICS device vulnerability with no public exploit identified at time of analysis and no KEV listing.
Authentication bypass in the Ebyte NE2-D11 serial-to-Ethernet gateway firmware lets unauthenticated remote attackers gain full administrative control by reproducing the device's client-side authentication logic. Because the login check runs in the client rather than being enforced server-side, an attacker can craft valid authentication requests without any credentials. No public exploit has been identified at time of analysis, but the flaw is trivially reproducible and carries a CVSS 4.0 base score of 9.3.
Privilege escalation in Sparx Enterprise Architect 17.1 and earlier allows an authenticated low-privilege user to impersonate any other user, including administrators, by tampering with the client-side application (e.g., via a debugger). Because role-based access enforcement happens in the client rather than on the server (CWE-603), an attacker who has any valid login can gain full repository control. No public exploit identified at time of analysis, although technical write-ups are referenced.
Client-side authentication bypass in mpGabinet 23.12.19 and earlier allows local authenticated attackers to impersonate arbitrary users by patching the application binary. An attacker with legitimate low-privilege access to the system can manipulate the compiled application code to skip login verification entirely, gaining unauthorized access as any user including administrators. EPSS score not available for this 2026 CVE; no active exploitation or public POC confirmed at time of analysis.
IAQS and I6 systems by JNC have a client-side enforcement vulnerability allowing unauthenticated attackers to bypass security controls and access server functionality.
Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WebAuthn policy enforcement bypass in Red Hat Build of Keycloak allows low-privileged authenticated users to register credentials that violate administrator-configured realm security policies. The server-side processAction() method does not validate that newly registered WebAuthn credential parameters - such as public key algorithms - conform to the realm's defined WebAuthn policies, enabling a user to manipulate client-side JavaScript during the registration flow to submit non-compliant credential data. No public exploit has been identified at time of analysis; exploitation requires an authenticated session and is limited to integrity impact (policy bypass), with no direct confidentiality or availability consequence.