Common Weakness Enumeration
CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
6300 vulnerabilities reference this CWE, most recent first.
CVE-2026-78434 (GCVE-0-2026-78434)
Vulnerability from cvelistv5 – Published: 2026-08-24 21:30 – Updated: 2026-08-24 21:30
VLAI
EPSS
VEX
Title
Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication
Summary
A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394712 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394712/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78434 | third-party-advisory |
| https://vuldb.com/submit/886394 | third-party-advisory |
| https://github.com/faveosuite/faveo-helpdesk/issu… | exploitissue-tracking |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:faveo:helpdesk:*:*:*:*:*:*:*:*"
],
"modules": [
"post-ticket-reply Endpoint"
],
"product": "Helpdesk",
"vendor": "Faveo",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "geochen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T21:30:08.526Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394712 | Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394712"
},
{
"name": "VDB-394712 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394712/cti"
},
{
"name": "CVE-2026-78434 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78434"
},
{
"name": "Submit #886394 | faveosuite faveo-helpdesk commit 6568aa4 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/886394"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/faveosuite/faveo-helpdesk/issues/8346"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-24T17:50:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78434",
"datePublished": "2026-08-24T21:30:08.526Z",
"dateReserved": "2026-08-24T15:45:35.346Z",
"dateUpdated": "2026-08-24T21:30:08.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78168 (GCVE-0-2026-78168)
Vulnerability from cvelistv5 – Published: 2026-08-24 01:30 – Updated: 2026-08-24 01:30
VLAI
EPSS
VEX
Title
EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication
Summary
A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
9.8 (Critical)
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394557 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394557/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78168 | third-party-advisory |
| https://vuldb.com/submit/883766 | third-party-advisory |
| https://github.com/AdminSafe/CVE/issues/10 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EFM | ipTIME T24000M |
Affected:
14.0
Affected: 14.1 Affected: 14.2 Affected: 14.3 Affected: 14.4 Affected: 14.5 Affected: 14.6 Affected: 14.7 Affected: 14.8 Affected: 14.9 Affected: 14.10 Affected: 14.11 Affected: 14.12 Affected: 14.13 Affected: 14.14 Affected: 14.15 Affected: 14.16 Affected: 14.17 Affected: 14.18 Affected: 14.19 Affected: 14.20.0 cpe:2.3:a:efm:iptime_t24000m:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:efm:iptime_t24000m:*:*:*:*:*:*:*:*"
],
"modules": [
"Session Validation Handler"
],
"product": "ipTIME T24000M",
"vendor": "EFM",
"versions": [
{
"status": "affected",
"version": "14.0"
},
{
"status": "affected",
"version": "14.1"
},
{
"status": "affected",
"version": "14.2"
},
{
"status": "affected",
"version": "14.3"
},
{
"status": "affected",
"version": "14.4"
},
{
"status": "affected",
"version": "14.5"
},
{
"status": "affected",
"version": "14.6"
},
{
"status": "affected",
"version": "14.7"
},
{
"status": "affected",
"version": "14.8"
},
{
"status": "affected",
"version": "14.9"
},
{
"status": "affected",
"version": "14.10"
},
{
"status": "affected",
"version": "14.11"
},
{
"status": "affected",
"version": "14.12"
},
{
"status": "affected",
"version": "14.13"
},
{
"status": "affected",
"version": "14.14"
},
{
"status": "affected",
"version": "14.15"
},
{
"status": "affected",
"version": "14.16"
},
{
"status": "affected",
"version": "14.17"
},
{
"status": "affected",
"version": "14.18"
},
{
"status": "affected",
"version": "14.19"
},
{
"status": "affected",
"version": "14.20.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "010hex (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T01:30:10.640Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394557 | EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394557"
},
{
"name": "VDB-394557 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394557/cti"
},
{
"name": "CVE-2026-78168 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78168"
},
{
"name": "Submit #883766 | EFM ipTIME T24000M Version 14.20.0 and earlier Remote Code Execution (RCE)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/883766"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/AdminSafe/CVE/issues/10"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T16:14:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78168",
"datePublished": "2026-08-24T01:30:10.640Z",
"dateReserved": "2026-08-23T14:09:41.997Z",
"dateUpdated": "2026-08-24T01:30:10.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78167 (GCVE-0-2026-78167)
Vulnerability from cvelistv5 – Published: 2026-08-24 01:15 – Updated: 2026-08-24 18:00
VLAI
EPSS
VEX
Title
EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication
Summary
A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 17:59 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394556 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394556/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78167 | third-party-advisory |
| https://vuldb.com/submit/874154 | third-party-advisory |
| https://vuldb.com/submit/874302 | third-party-advisory |
| https://github.com/AdminSafe/CVE/issues/2 | issue-tracking |
| https://github.com/AdminSafe/CVE/issues/3 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EFM | ipTIME T16000M |
Affected:
14.20.2
cpe:2.3:a:efm:iptime_t16000m:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78167",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T17:59:47.024111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T18:00:21.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:efm:iptime_t16000m:*:*:*:*:*:*:*:*"
],
"modules": [
"Session Validation Handler"
],
"product": "ipTIME T16000M",
"vendor": "EFM",
"versions": [
{
"status": "affected",
"version": "14.20.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "010hex (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T01:15:12.094Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394556 | EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394556"
},
{
"name": "VDB-394556 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394556/cti"
},
{
"name": "CVE-2026-78167 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78167"
},
{
"name": "Submit #874154 | EFM ipTIME T16000M 14.20.2 Remote Code Execution (RCE)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/874154"
},
{
"name": "Submit #874302 | EFM ipTIME T16000M 14.20.2 Arbitrary Password Reset Due to Authentication Bypass (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/874302"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/AdminSafe/CVE/issues/2"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/AdminSafe/CVE/issues/3"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T16:13:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78167",
"datePublished": "2026-08-24T01:15:12.094Z",
"dateReserved": "2026-08-23T14:08:43.212Z",
"dateUpdated": "2026-08-24T18:00:21.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78154 (GCVE-0-2026-78154)
Vulnerability from cvelistv5 – Published: 2026-08-23 23:30 – Updated: 2026-08-25 08:26
VLAI
EPSS
VEX
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it's redeemed for SDK-scoped tokens.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-08-25T08:26:02.821Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"rejectedReasons": [
{
"lang": "en",
"value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The endpoint is public on purpose and the invitation code is the credential. This is the standalone SDK onboarding path for mobile apps that have no backend of their own: a developer generates a code via the authenticated dashboard endpoint, the user types it into the app, and it\u0027s redeemed for SDK-scoped tokens."
}
],
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78154",
"datePublished": "2026-08-23T23:30:09.983Z",
"dateRejected": "2026-08-25T08:26:02.821Z",
"dateReserved": "2026-08-23T07:42:52.545Z",
"dateUpdated": "2026-08-25T08:26:02.821Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77567 (GCVE-0-2026-77567)
Vulnerability from cvelistv5 – Published: 2026-08-24 20:10 – Updated: 2026-08-24 20:10
VLAI
EPSS
VEX
Title
Filament: App-based MFA can be bypassed when recovery codes are enabled
Summary
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.
Severity
8.1 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/filamentphp/filament/security/… | x_refsource_CONFIRM |
| https://github.com/filamentphp/filament/commit/45… | x_refsource_MISC |
| https://github.com/filamentphp/filament/releases/… | x_refsource_MISC |
| https://github.com/filamentphp/filament/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| filamentphp | filament |
Affected:
>= 4.0.0, < 4.12.0
Affected: >= 5.0.0, < 5.7.0 |
{
"containers": {
"cna": {
"affected": [
{
"product": "filament",
"vendor": "filamentphp",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.12.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T20:10:58.326Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c"
},
{
"name": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b"
},
{
"name": "https://github.com/filamentphp/filament/releases/tag/v4.12.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filamentphp/filament/releases/tag/v4.12.0"
},
{
"name": "https://github.com/filamentphp/filament/releases/tag/v5.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/filamentphp/filament/releases/tag/v5.7.0"
}
],
"source": {
"advisory": "GHSA-52xp-w8hr-xv3c",
"discovery": "UNKNOWN"
},
"title": "Filament: App-based MFA can be bypassed when recovery codes are enabled"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77567",
"datePublished": "2026-08-24T20:10:58.326Z",
"dateReserved": "2026-08-20T20:35:30.147Z",
"dateUpdated": "2026-08-24T20:10:58.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-76338 (GCVE-0-2026-76338)
Vulnerability from cvelistv5 – Published: 2026-08-19 21:34 – Updated: 2026-08-21 03:56
VLAI
EPSS
VEX
Title
Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and authentication.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 00:00 UTC
CWE
- CWE-287 - When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Splunk | Splunk Enterprise |
Affected:
10.4 , < 10.4.2
(custom)
Affected: 10.2 , < 10.2.6 (custom) Affected: 10.0 , < 10.0.9 (custom) Affected: 9.4 , < 9.4.14 (custom) |
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-76338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T03:56:21.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "10.4.2",
"status": "affected",
"version": "10.4",
"versionType": "custom"
},
{
"lessThan": "10.2.6",
"status": "affected",
"version": "10.2",
"versionType": "custom"
},
{
"lessThan": "10.0.9",
"status": "affected",
"version": "10.0",
"versionType": "custom"
},
{
"lessThan": "9.4.14",
"status": "affected",
"version": "9.4",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/markdown",
"value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see [About distributed search](https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and [authentication.conf](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation."
}
],
"value": "In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signed request to identify a configured search peer, allowing the request to fall back to shared local key material. For more information see About distributed search (https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/10.4/overview-of-distributed-search/about-distributed-search) and authentication.conf (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in Splunk documentation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T21:34:37.625Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0801"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.\n\nSet `strictPeerNameValidation = true` in `authentication.conf` on every distributed node, then restart Splunk Enterprise."
}
],
"source": {
"advisory": "SVD-2026-0801"
},
"title": "Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise",
"workarounds": [
{
"lang": "en",
"value": "Turn off legacy distributed search token fallback by setting strictPeerNameValidation = true in the authentication.conf configuration file if you do not use distributed search peers that omit peername. Restart Splunk Enterprise on every node in the distributed environment after applying the setting. For more information see [authentication.conf](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/configuration-file-reference/10.4.2-configuration-file-reference/authentication.conf) in the Splunk documentation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2026-76338",
"datePublished": "2026-08-19T21:34:37.625Z",
"dateReserved": "2026-08-19T12:02:03.627Z",
"dateUpdated": "2026-08-21T03:56:21.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75774 (GCVE-0-2026-75774)
Vulnerability from cvelistv5 – Published: 2026-08-18 11:15 – Updated: 2026-08-18 13:59
VLAI
EPSS
VEX
Title
karakeep-app karakeep OAuth Sign-In auth.ts improper authentication
Summary
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 13:55 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391520 | vdb-entry |
| https://vuldb.com/vuln/391520/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-75774 | third-party-advisory |
| https://vuldb.com/submit/877732 | third-party-advisory |
| https://github.com/karakeep-app/karakeep/issues/2920 | exploitissue-tracking |
| https://github.com/karakeep-app/karakeep/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| karakeep-app | karakeep |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16 Affected: 0.17 Affected: 0.18 Affected: 0.19 Affected: 0.20 Affected: 0.21 Affected: 0.22 Affected: 0.23 Affected: 0.24 Affected: 0.25 Affected: 0.26 Affected: 0.27 Affected: 0.28 Affected: 0.29 Affected: 0.30 Affected: 0.31 Affected: 0.32.0 cpe:2.3:a:karakeep-app:karakeep:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75774",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:55:10.312544Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:59:32.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:karakeep-app:karakeep:*:*:*:*:*:*:*:*"
],
"modules": [
"OAuth Sign-In"
],
"product": "karakeep",
"vendor": "karakeep-app",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16"
},
{
"status": "affected",
"version": "0.17"
},
{
"status": "affected",
"version": "0.18"
},
{
"status": "affected",
"version": "0.19"
},
{
"status": "affected",
"version": "0.20"
},
{
"status": "affected",
"version": "0.21"
},
{
"status": "affected",
"version": "0.22"
},
{
"status": "affected",
"version": "0.23"
},
{
"status": "affected",
"version": "0.24"
},
{
"status": "affected",
"version": "0.25"
},
{
"status": "affected",
"version": "0.26"
},
{
"status": "affected",
"version": "0.27"
},
{
"status": "affected",
"version": "0.28"
},
{
"status": "affected",
"version": "0.29"
},
{
"status": "affected",
"version": "0.30"
},
{
"status": "affected",
"version": "0.31"
},
{
"status": "affected",
"version": "0.32.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZAST.AI (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T11:15:09.946Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391520 | karakeep-app karakeep OAuth Sign-In auth.ts improper authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/391520"
},
{
"name": "VDB-391520 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391520/cti"
},
{
"name": "CVE-2026-75774 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-75774"
},
{
"name": "Submit #877732 | karakeep-app karakeep \u003e= 0.26.0, \u003c= 0.32.0 Improper Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/877732"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/karakeep-app/karakeep/issues/2920"
},
{
"tags": [
"product"
],
"url": "https://github.com/karakeep-app/karakeep/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-18T06:35:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "karakeep-app karakeep OAuth Sign-In auth.ts improper authentication",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-75774",
"datePublished": "2026-08-18T11:15:09.946Z",
"dateReserved": "2026-08-18T04:30:33.990Z",
"dateUpdated": "2026-08-18T13:59:32.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74894 (GCVE-0-2026-74894)
Vulnerability from cvelistv5 – Published: 2026-08-17 11:04 – Updated: 2026-08-17 16:03
VLAI
EPSS
VEX
Title
openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token
Summary
openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 16:00 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/jahlives/openssl_encrypt/secur… | vendor-advisory |
| https://www.vulncheck.com/advisories/openssl-encr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jahlives | openssl_encrypt |
Affected:
0 , < 1.4.0
(semver)
Unaffected: 1.4.0 (semver) |
Date Public
2026-02-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74894",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T16:00:51.628767Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T16:03:26.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/openssl_encrypt",
"product": "openssl_encrypt",
"vendor": "jahlives",
"versions": [
{
"lessThan": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.4.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-02-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload arbitrary public keys, enumerate all keys, and revoke keys belonging to any user by providing any Bearer token in the Authorization header."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T11:04:56.540Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4g2c-wpgj-49w8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-4g2c-wpgj-49w8"
},
{
"name": "VulnCheck Advisory: openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openssl-encrypt-before-authentication-bypass-via-bearer-token"
}
],
"title": "openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74894",
"datePublished": "2026-08-17T11:04:56.540Z",
"dateReserved": "2026-08-17T10:42:40.455Z",
"dateUpdated": "2026-08-17T16:03:26.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74240 (GCVE-0-2026-74240)
Vulnerability from cvelistv5 – Published: 2026-08-14 22:43 – Updated: 2026-08-20 14:12
VLAI
EPSS
VEX
Title
Quay: jwt claim validation bypasses in quay federated robot and sso authentication
Summary
A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 14:11 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-74240 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2516139 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Update Service |
cpe:/a:redhat:openshift_update_service:5
|
|
| Red Hat | Red Hat Quay 3 |
cpe:/a:redhat:quay:3
|
Date Public
2026-08-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T14:11:52.563154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T14:12:03.863Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_update_service:5"
],
"defaultStatus": "affected",
"packageName": "openshift-update-service/openshift-update-service-rhel8",
"product": "Red Hat OpenShift Update Service",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue."
}
],
"datePublic": "2026-08-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Red Hat Quay\u0027s JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T22:43:01.103Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-74240"
},
{
"name": "RHBZ#2516139",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516139"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T09:28:14.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Quay: jwt claim validation bypasses in quay federated robot and sso authentication",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, Red Hat Quay administrators should ensure that federated robot authentication is configured with specific audiences to enable \u0027verify_aud\u0027 enforcement. Additionally, review and update existing federation configurations to explicitly include and enforce \u0027azp\u0027 and \u0027sub\u0027 claims, preventing bypasses when these claims are absent. Refer to Red Hat Quay documentation for detailed configuration steps. A restart of affected Quay services may be required after configuration changes."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-287: Improper Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-74240",
"datePublished": "2026-08-14T22:43:01.103Z",
"dateReserved": "2026-08-14T19:46:37.190Z",
"dateUpdated": "2026-08-20T14:12:03.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73840 (GCVE-0-2026-73840)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:52 – Updated: 2026-08-14 16:26
VLAI
EPSS
VEX
Title
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Summary
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:25 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4239 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4252 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4253 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/2… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/8… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/f… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
< 1.0.3
Affected: >= 1.1.0, < 1.1.3 Affected: >= 1.2.0-rc.1, < 1.2.0-rc.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73840",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:25:46.438980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:26:09.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.3"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.3"
},
{
"status": "affected",
"version": "\u003e= 1.2.0-rc.1, \u003c 1.2.0-rc.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T21:52:27.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4239",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4239"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4252",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4252"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4253",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4253"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127b"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2"
}
],
"source": {
"advisory": "GHSA-c5f6-2rm9-2w8g",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73840",
"datePublished": "2026-08-13T21:52:27.798Z",
"dateReserved": "2026-08-13T17:44:28.640Z",
"dateUpdated": "2026-08-14T16:26:09.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.