Common Weakness Enumeration
CWE-287
Weakness DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Dimensions
- Behavior-Property: Improper
- Behavior-Type: Authentication
Mapping guidance
This CWE entry might be misused when lower-level CWE entries are likely to be applicable. It is a level-1 Class (i.e., a child of a Pillar).
Consider children or descendants.
Modes of introduction
Architecture and Design
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Detection methods
Automated Static Analysis
Automated static analysis is useful for detecting certain types of authentication. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authentication libraries.
Generally, automated static analysis tools have difficulty detecting custom authentication schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an established identity; an automated technique that detects the absence of authentication may report false positives.
Effectiveness: Limited
Manual Static Analysis
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
Manual static analysis is useful for evaluating the correctness of custom authentication mechanisms.
Effectiveness: High
These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules.
Manual Static Analysis - Binary or Bytecode
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness: SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Web Application Scanner
Web Services Scanner
Database Scanners
Effectiveness: SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Fuzz Tester
Framework-based Fuzzer
Effectiveness: SOAR Partial
Manual Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Manual Source Code Review (not inspections)
Effectiveness: SOAR Partial
Automated Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
Automated Static Analysis
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Configuration Checker
Effectiveness: SOAR Partial
Architecture or Design Review
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction
Effectiveness: High
Notes
Relationship
This can be resultant from SQL injection vulnerabilities and other issues.
Content history
Submission: PLOVER
· 2006-07-19
· CWE Draft 3
Contribution: Abhi Balakrishnan
· 2024-02-29
· CWE 4.15
Provided diagram to improve CWE usability
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification:
· Veracode
· 2008-08-15
· CWE 1.0
Suggested OWASP Top Ten 2004 mapping
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Alternate_Terms, Common_Consequences, Relationships, Relationship_Notes, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2008-10-14
· CWE 1.0.1
updated Relationships
Modification: CWE Content Team
· MITRE
· 2009-01-12
· CWE 1.2
updated Name
Modification: CWE Content Team
· MITRE
· 2009-05-27
· CWE 1.4
updated Description, Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2009-07-27
· CWE 1.5
updated Relationships
Modification: CWE Content Team
· MITRE
· 2009-10-29
· CWE 1.6
updated Common_Consequences, Observed_Examples
Modification: CWE Content Team
· MITRE
· 2009-12-28
· CWE 1.7
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, References
Modification: CWE Content Team
· MITRE
· 2010-02-16
· CWE 1.8
updated Alternate_Terms, Detection_Factors, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2010-06-21
· CWE 1.9
updated Relationships
Modification: CWE Content Team
· MITRE
· 2011-03-29
· CWE 1.12
updated Relationships
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2013-07-17
· CWE 2.5
updated Relationships
Modification: CWE Content Team
· MITRE
· 2014-02-18
· CWE 2.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2014-06-23
· CWE 2.7
updated Relationships
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Detection_Factors, Relationships
Modification: CWE Content Team
· MITRE
· 2015-12-07
· CWE 2.9
updated Relationships
Modification: CWE Content Team
· MITRE
· 2017-01-19
· CWE 2.10
updated Relationships
Modification: CWE Content Team
· MITRE
· 2017-05-03
· CWE 2.11
updated Related_Attack_Patterns, Relationships
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Demonstrative_Examples, Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships
Modification: CWE Content Team
· MITRE
· 2018-03-27
· CWE 3.1
updated References, Relationships
Modification: CWE Content Team
· MITRE
· 2019-01-03
· CWE 3.2
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Demonstrative_Examples, Related_Attack_Patterns, Relationships
Modification: CWE Content Team
· MITRE
· 2019-09-19
· CWE 3.4
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-08-20
· CWE 4.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-12-10
· CWE 4.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-03-15
· CWE 4.4
updated Alternate_Terms, Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2021-07-20
· CWE 4.5
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-06-28
· CWE 4.8
updated Observed_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description, Maintenance_Notes, Observed_Examples, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Demonstrative_Examples, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes, Relationships
Modification: CWE Content Team
· MITRE
· 2023-10-26
· CWE 4.13
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2024-02-29
· CWE 4.14
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2024-07-16
· CWE 4.15
updated Diagram
Modification: CWE Content Team
· MITRE
· 2024-11-19
· CWE 4.16
updated Relationships
Modification: CWE Content Team
· MITRE
· 2025-04-03
· CWE 4.17
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2025-09-09
· CWE 4.18
updated Demonstrative_Examples, Detection_Factors, References
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Applicable_Platforms, Maintenance_Notes, Relationships, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-01-21
· CWE 4.19.1
updated Relationships
Modification: CWE Content Team
· MITRE
· 2026-04-30
· CWE 4.20
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Demonstrative_Examples, Dimensions, Observed_Examples, References, Relationships
7306 vulnerabilities reference this CWE, most recent first.
GCVE-1337-2026-000000000… (CVE-2026-105034)
Vulnerability from gna-1337 – Published: 2026-10-15 20:42 – Updated: 2026-10-15 20:42
VLAI
EPSS
VEX
Title
EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
Summary
The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.
Severity
8.2 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CNA · AHA (v2.0.3)
References
3 references
| URL | Tags |
|---|---|
| https://github.com/xn0tsa/your-secrets-are-safe-with-me | technical-description |
| https://takeonme.org/gcves/GCVE-1337-2026-0000000… | third-party-advisory |
| https://www.theverge.com/tech/1010727/eiliko-robo… | media-coverage |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EnergizeLab | NestJS auth service |
Affected:
1.8.2
|
Date Public
2026-10-15 12:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NestJS auth service",
"vendor": "EnergizeLab",
"versions": [
{
"status": "affected",
"version": "1.8.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sammy Azdoufal"
},
{
"lang": "en",
"type": "coordinator",
"value": "todb of AHA!"
}
],
"datePublic": "2026-10-15T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services."
}
],
"value": "The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T20:42:42.975Z",
"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"shortName": "AHA"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/xn0tsa/your-secrets-are-safe-with-me"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111001111111111000000000000000000010110111111111100000000000000000001110/"
},
{
"tags": [
"media-coverage"
],
"url": "https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1337-2026-00000000000000000001111111111100000000000000000000000011111111001111111111000000000000000000010110111111111100000000000000000001110"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43",
"assignerShortName": "AHA",
"cveId": "CVE-2026-105034",
"datePublished": "2026-10-15T20:42:42.975Z",
"dateReserved": "2026-10-02T21:30:55.242Z",
"dateUpdated": "2026-10-15T20:42:42.975Z",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "GCVE-1337-2026-00000000000000000001111111111100000000000000000000000011111111001111111111000000000000000000010110111111111100000000000000000001110"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124578 (GCVE-0-2026-124578)
Vulnerability from cvelistv5 – Published: 2026-11-09 07:30 – Updated: 2026-11-09 07:30
VLAI
EPSS
VEX
Title
Pantum BP5100DW Web omDB.shtml missing authentication
Summary
A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432924 | vdb-entry |
| https://vuldb.com/vuln/432924/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124578 | third-party-advisory |
| https://vuldb.com/submit/1038185 | third-party-advisory |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:pantum:bp5100dw:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Interface"
],
"product": "BP5100DW",
"vendor": "Pantum",
"versions": [
{
"status": "affected",
"version": "3.A.4.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JoasHS (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T07:30:16.490Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432924 | Pantum BP5100DW Web omDB.shtml missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/432924"
},
{
"name": "VDB-432924 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432924/cti"
},
{
"name": "CVE-2026-124578 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124578"
},
{
"name": "Submit #1038185 | Zhuhai Pantum Electronics BP5100DW printer Firmware 3.A.4.7 Unauthenticated disclosure of device configuration and credentials via /shtml/omDB.shtml",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1038185"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T18:12:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "Pantum BP5100DW Web omDB.shtml missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124578",
"datePublished": "2026-11-09T07:30:16.490Z",
"dateReserved": "2026-11-08T17:07:13.997Z",
"dateUpdated": "2026-11-09T07:30:16.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124577 (GCVE-0-2026-124577)
Vulnerability from cvelistv5 – Published: 2026-11-09 07:15 – Updated: 2026-11-09 07:15
VLAI
EPSS
VEX
Title
Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication
Summary
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised.
Severity
9.8 (Critical)
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432923 | vdb-entry |
| https://vuldb.com/vuln/432923/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124577 | third-party-advisory |
| https://vuldb.com/submit/1038184 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intelbras | SG 2404 PoE L2+ |
Affected:
1.00.70
Affected: 1.00.72 Unaffected: 1.00.74 cpe:2.3:h:intelbras:sg_2404_poe_l2_:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:intelbras:sg_2404_poe_l2_:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "SG 2404 PoE L2+",
"vendor": "Intelbras",
"versions": [
{
"status": "affected",
"version": "1.00.70"
},
{
"status": "affected",
"version": "1.00.72"
},
{
"status": "unaffected",
"version": "1.00.74"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JoasHS (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB Vulnerability Moderation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.00.74 is sufficient to fix this issue. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T07:15:16.393Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432923 | Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/432923"
},
{
"name": "VDB-432923 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432923/cti"
},
{
"name": "CVE-2026-124577 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124577"
},
{
"name": "Submit #1038184 | Intelbras SG 2404 PoE L2+ managed switch Firmware 1.00.70, 1.00.72 (hardware B1) Authentication bypass in web management interface allows unauthenticated execution of privileged CLI commands via /EXCU_SHELL",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1038184"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T18:07:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124577",
"datePublished": "2026-11-09T07:15:16.393Z",
"dateReserved": "2026-11-08T17:02:20.350Z",
"dateUpdated": "2026-11-09T07:15:16.393Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124573 (GCVE-0-2026-124573)
Vulnerability from cvelistv5 – Published: 2026-11-09 06:15 – Updated: 2026-11-09 06:15
VLAI
EPSS
VEX
Title
logseq Local HTTP API server.cljs validate-auth-token missing authentication
Summary
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432919 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432919/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124573 | third-party-advisory |
| https://vuldb.com/submit/1035945 | third-party-advisory |
| https://github.com/logseq/logseq/issues/13596 | exploitissue-tracking |
| https://github.com/logseq/logseq/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:logseq:logseq:*:*:*:*:*:*:*:*"
],
"modules": [
"Local HTTP API"
],
"product": "logseq",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "akamoli (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T06:15:15.285Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432919 | logseq Local HTTP API server.cljs validate-auth-token missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432919"
},
{
"name": "VDB-432919 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432919/cti"
},
{
"name": "CVE-2026-124573 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124573"
},
{
"name": "Submit #1035945 | https://github.com/logseq logseq 2.0.1 Local Sensitive Logic exposure lead to Command Execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035945"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/logseq/logseq/issues/13596"
},
{
"tags": [
"product"
],
"url": "https://github.com/logseq/logseq/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T17:56:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "logseq Local HTTP API server.cljs validate-auth-token missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124573",
"datePublished": "2026-11-09T06:15:15.285Z",
"dateReserved": "2026-11-08T16:51:31.805Z",
"dateUpdated": "2026-11-09T06:15:15.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123963 (GCVE-0-2026-123963)
Vulnerability from cvelistv5 – Published: 2026-11-07 12:30 – Updated: 2026-11-07 12:30
VLAI
EPSS
VEX
Title
OpenBMB Internet of Agents Agent Registry app.py register missing authentication
Summary
A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432033 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432033/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123963 | third-party-advisory |
| https://vuldb.com/submit/1033797 | third-party-advisory |
| https://github.com/OpenBMB/IoA/issues/21 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenBMB | Internet of Agents |
Affected:
9d78e88e47160eb42ee1ee8538c05e1c2c47877a
cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:*"
],
"modules": [
"Agent Registry"
],
"product": "Internet of Agents",
"vendor": "OpenBMB",
"versions": [
{
"status": "affected",
"version": "9d78e88e47160eb42ee1ee8538c05e1c2c47877a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Evo1ution (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file im_server/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T12:30:12.500Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432033 | OpenBMB Internet of Agents Agent Registry app.py register missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432033"
},
{
"name": "VDB-432033 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432033/cti"
},
{
"name": "CVE-2026-123963 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123963"
},
{
"name": "Submit #1033797 | OpenBMB Internet of Agents(IoA) 9d78e88 Improper Input Validation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033797"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/OpenBMB/IoA/issues/21"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-06T18:17:37.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenBMB Internet of Agents Agent Registry app.py register missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123963",
"datePublished": "2026-11-07T12:30:12.500Z",
"dateReserved": "2026-11-06T17:12:27.519Z",
"dateUpdated": "2026-11-07T12:30:12.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123032 (GCVE-0-2026-123032)
Vulnerability from cvelistv5 – Published: 2026-11-05 14:15 – Updated: 2026-11-05 16:26
VLAI
EPSS
VEX
Title
OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication
Summary
A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:25 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431401 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431401/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123032 | third-party-advisory |
| https://vuldb.com/submit/1033550 | third-party-advisory |
| https://github.com/OpenBMB/IoA/issues/17 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenBMB | Internet of Agents |
Affected:
9d78e88e47160eb42ee1ee8538c05e1c2c47877a
cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123032",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:25:27.270344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:26:03.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openbmb:internet_of_agents:*:*:*:*:*:*:*:*"
],
"modules": [
"WebSocket Connection Manager"
],
"product": "Internet of Agents",
"vendor": "OpenBMB",
"versions": [
{
"status": "affected",
"version": "9d78e88e47160eb42ee1ee8538c05e1c2c47877a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Evo1ution (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function ConnectionManager.connect of the file im_server/app.py of the component WebSocket Connection Manager. The manipulation of the argument agent_name results in missing authentication. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T14:15:09.069Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431401 | OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431401"
},
{
"name": "VDB-431401 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431401/cti"
},
{
"name": "CVE-2026-123032 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123032"
},
{
"name": "Submit #1033550 | OpenBMB Internet of Agents(IoA) 9d78e88 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033550"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/OpenBMB/IoA/issues/17"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-05T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-05T07:56:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123032",
"datePublished": "2026-11-05T14:15:09.069Z",
"dateReserved": "2026-11-05T06:51:10.681Z",
"dateUpdated": "2026-11-05T16:26:03.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123024 (GCVE-0-2026-123024)
Vulnerability from cvelistv5 – Published: 2026-11-05 13:45 – Updated: 2026-11-05 21:22
VLAI
EPSS
VEX
Title
agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication
Summary
A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:22 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431397 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431397/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123024 | third-party-advisory |
| https://vuldb.com/submit/1033132 | third-party-advisory |
| https://github.com/agentscope-ai/agentscope/issues/3314 | issue-tracking |
| https://github.com/agentscope-ai/agentscope/pull/3448 | issue-trackingpatch |
| https://github.com/ybyu-ieu/agent-security-adviso… | exploit |
| https://github.com/agentscope-ai/agentscope/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| agentscope-ai | AgentScope |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123024",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:22:11.821672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:22:16.968Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"
],
"modules": [
"Agent Service"
],
"product": "AgentScope",
"vendor": "agentscope-ai",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ybyu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T13:45:17.370Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431397 | agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431397"
},
{
"name": "VDB-431397 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431397/cti"
},
{
"name": "CVE-2026-123024 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123024"
},
{
"name": "Submit #1033132 | agentscope-ai AgentScope 2.0.4 CWE-306 Missing Authentication for Critical Function",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033132"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/agentscope-ai/agentscope/issues/3314"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/agentscope-ai/agentscope/pull/3448"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-agent-service-x-user-id-missing-authentication.md"
},
{
"tags": [
"product"
],
"url": "https://github.com/agentscope-ai/agentscope/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-05T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-05T07:31:14.000Z",
"value": "VulDB entry last update"
}
],
"title": "agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123024",
"datePublished": "2026-11-05T13:45:17.370Z",
"dateReserved": "2026-11-05T06:25:59.245Z",
"dateUpdated": "2026-11-05T21:22:16.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122236 (GCVE-0-2026-122236)
Vulnerability from cvelistv5 – Published: 2026-11-05 03:45 – Updated: 2026-11-05 20:53 X_Open Source
VLAI
EPSS
VEX
Title
OpenHands Landing missing authentication
Summary
A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:53 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431199 | vdb-entry |
| https://vuldb.com/vuln/431199/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122236 | third-party-advisory |
| https://vuldb.com/submit/1031850 | third-party-advisory |
| https://github.com/OpenHands/OpenHands/issues/17878 | exploitissue-tracking |
| https://github.com/OpenHands/OpenHands/pull/17007 | issue-trackingpatch |
| https://github.com/OpenHands/OpenHands/commit/c5e… | patch |
| https://github.com/OpenHands/OpenHands/releases/t… | patch |
| https://github.com/OpenHands/OpenHands/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | OpenHands |
Affected:
1.0
Affected: 1.1 Affected: 1.2 Affected: 1.3 Affected: 1.4 Affected: 1.5 Affected: 1.6 Affected: 1.7 Affected: 1.8 Affected: 1.9 Affected: 1.10 Affected: 1.11 Affected: 1.12 Affected: 1.13 Affected: 1.14 Affected: 1.15 Affected: 1.16 Affected: 1.17 Affected: 1.18 Affected: 1.19 Affected: 1.20 Affected: 1.21 Affected: 1.22 Affected: 1.23 Affected: 1.24.0 Unaffected: 1.25.0 cpe:2.3:a:openhands:openhands:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122236",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:53:14.364420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:53:23.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openhands:openhands:*:*:*:*:*:*:*:*"
],
"modules": [
"Landing Page"
],
"product": "OpenHands",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "1.2"
},
{
"status": "affected",
"version": "1.3"
},
{
"status": "affected",
"version": "1.4"
},
{
"status": "affected",
"version": "1.5"
},
{
"status": "affected",
"version": "1.6"
},
{
"status": "affected",
"version": "1.7"
},
{
"status": "affected",
"version": "1.8"
},
{
"status": "affected",
"version": "1.9"
},
{
"status": "affected",
"version": "1.10"
},
{
"status": "affected",
"version": "1.11"
},
{
"status": "affected",
"version": "1.12"
},
{
"status": "affected",
"version": "1.13"
},
{
"status": "affected",
"version": "1.14"
},
{
"status": "affected",
"version": "1.15"
},
{
"status": "affected",
"version": "1.16"
},
{
"status": "affected",
"version": "1.17"
},
{
"status": "affected",
"version": "1.18"
},
{
"status": "affected",
"version": "1.19"
},
{
"status": "affected",
"version": "1.20"
},
{
"status": "affected",
"version": "1.21"
},
{
"status": "affected",
"version": "1.22"
},
{
"status": "affected",
"version": "1.23"
},
{
"status": "affected",
"version": "1.24.0"
},
{
"status": "unaffected",
"version": "1.25.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "huan"
},
{
"lang": "en",
"type": "finder",
"value": "notwo1f"
},
{
"lang": "en",
"type": "reporter",
"value": "PoriaMs (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "PoriaMs (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T13:25:29.990Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431199 | OpenHands Landing missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/431199"
},
{
"name": "VDB-431199 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431199/cti"
},
{
"name": "CVE-2026-122236 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122236"
},
{
"name": "Submit #1031850 | https://github.com/OpenHands OpenHands 1.20.0 Local Sensitive Logic Exposure leading to Remote Code Execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1031850"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/OpenHands/OpenHands/issues/17878"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/OpenHands/OpenHands/pull/17007"
},
{
"tags": [
"patch"
],
"url": "https://github.com/OpenHands/OpenHands/commit/c5efa3ae415def0a903c82d2b17b748e663b1995"
},
{
"tags": [
"patch"
],
"url": "https://github.com/OpenHands/OpenHands/releases/tag/v1.25.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/OpenHands/OpenHands/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-05T14:27:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenHands Landing missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122236",
"datePublished": "2026-11-05T03:45:18.877Z",
"dateReserved": "2026-11-04T20:52:59.590Z",
"dateUpdated": "2026-11-05T20:53:23.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121933 (GCVE-0-2026-121933)
Vulnerability from cvelistv5 – Published: 2026-11-04 19:15 – Updated: 2026-11-04 19:15
VLAI
EPSS
VEX
Title
Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication
Summary
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431045 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431045/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121933 | third-party-advisory |
| https://vuldb.com/submit/1024276 | third-party-advisory |
| https://github.com/Zimo-666/E5350-cves/tree/main/… | exploit |
| https://www.linksys.com/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:h:linksys:e5350:*:*:*:*:*:*:*:*"
],
"modules": [
"Setup Wizard"
],
"product": "E5350",
"vendor": "Linksys",
"versions": [
{
"status": "affected",
"version": "1.0.00.037"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "liuyingqi (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T19:15:17.845Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431045 | Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431045"
},
{
"name": "VDB-431045 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431045/cti"
},
{
"name": "CVE-2026-121933 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121933"
},
{
"name": "Submit #1024276 | Linksys E5350 1.0.00.037 Improper Authentication (CWE-258 / CWE-306)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1024276"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Zimo-666/E5350-cves/tree/main/02-empty-admin-password-auth-bypass"
},
{
"tags": [
"product"
],
"url": "https://www.linksys.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T12:45:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121933",
"datePublished": "2026-11-04T19:15:17.845Z",
"dateReserved": "2026-11-04T11:39:36.243Z",
"dateUpdated": "2026-11-04T19:15:17.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121926 (GCVE-0-2026-121926)
Vulnerability from cvelistv5 – Published: 2026-11-04 17:00 – Updated: 2026-11-04 17:00
VLAI
EPSS
VEX
Title
yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication
Summary
A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431035 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431035/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121926 | third-party-advisory |
| https://vuldb.com/submit/1023350 | third-party-advisory |
| https://gist.github.com/janceye26-svg/eddbfcd42bb… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| yezhihao | jt808-server |
Affected:
a07f68c466b560b97ef41edb8a4966469abdf83e
cpe:2.3:a:yezhihao:jt808-server:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yezhihao:jt808-server:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management API"
],
"product": "jt808-server",
"vendor": "yezhihao",
"versions": [
{
"status": "affected",
"version": "a07f68c466b560b97ef41edb8a4966469abdf83e"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jance (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:00:16.338Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431035 | yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431035"
},
{
"name": "VDB-431035 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431035/cti"
},
{
"name": "CVE-2026-121926 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121926"
},
{
"name": "Submit #1023350 | yezhihao jt808-server a07f68c466b560b97ef41edb8a4966469abdf83e CWE-306 Missing Authentication for Critical Function",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1023350"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/janceye26-svg/eddbfcd42bbd90613dddcb7965408bf9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T12:35:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121926",
"datePublished": "2026-11-04T17:00:16.338Z",
"dateReserved": "2026-11-04T11:30:31.509Z",
"dateUpdated": "2026-11-04T17:00:16.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.