Common Weakness Enumeration
CWE-290
AllowedAuthentication Bypass by Spoofing
Abstraction: Base · Status: Incomplete
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
1288 vulnerabilities reference this CWE, most recent first.
CVE-2026-119703 (GCVE-0-2026-119703)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:19
VLAI
EPSS
VEX
Title
xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header
Summary
xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.
Severity
4.8 (Medium)
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/xinnan-tech/xiaozhi-esp32-serv… | issue-tracking |
| https://github.com/xinnan-tech/xiaozhi-esp32-server | product |
| https://github.com/xinnan-tech/xiaozhi-esp32-serv… | technical-description |
| https://github.com/xinnan-tech/xiaozhi-esp32-serv… | patchissue-tracking |
| https://www.vulncheck.com/advisories/xiaozhi-esp3… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xinnan-tech | xiaozhi-esp32-server |
Affected:
0 , ≤ 0.9.8
(semver)
|
Date Public
2026-10-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "xiaozhi-esp32-server",
"vendor": "xinnan-tech",
"versions": [
{
"lessThanOrEqual": "0.9.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device\u0027s conversation context."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:19:20.269Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3448",
"tags": [
"issue-tracking"
],
"url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3448"
},
{
"tags": [
"product"
],
"url": "https://github.com/xinnan-tech/xiaozhi-esp32-server"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.8/main/xiaozhi-server/core/websocket_server.py#L211-L232"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3457"
},
{
"name": "VulnCheck Advisory: xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/xiaozhi-esp32-server-through-0.9.8-authentication-bypass-via-spoofed-device-id-header"
}
],
"title": "xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119703",
"datePublished": "2026-10-30T15:16:03.996Z",
"dateReserved": "2026-10-30T14:49:22.241Z",
"dateUpdated": "2026-10-30T15:19:20.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119425 (GCVE-0-2026-119425)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
Summary
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://github.com/opnsense/core/commit/f46836d0c… | patch |
| https://github.com/opnsense/core/commit/32dc2a3e5… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://abraxaslabs.tech/research/opnsense-captiv… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-26.… | third-party-advisory |
Impacted products
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:58.656589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:05.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThanOrEqual": "26.7.7",
"status": "affected",
"version": "26.1.6",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.7.7",
"versionStartIncluding": "26.1.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lujiefsi"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim\u0027s MAC, gaining portal access with traffic attributed to the victim."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:55.121Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-864r-q4j5-5mjq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-864r-q4j5-5mjq"
},
{
"name": "Incomplete fix",
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/f46836d0c3d14e26d79214009bfbfa9a1eecab55"
},
{
"name": "Incomplete fix (stable/26.7)",
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/32dc2a3e52eefef5251077f315a0f3243eedb834"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-background-process.py#L78"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-26.1.6-through-26.7.7-captive-portal-session-takeover-via-forged-arp"
}
],
"title": "OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119425",
"datePublished": "2026-10-30T11:30:55.121Z",
"dateReserved": "2026-10-30T02:41:13.938Z",
"dateUpdated": "2026-10-30T15:55:05.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118653 (GCVE-0-2026-118653)
Vulnerability from cvelistv5 – Published: 2026-10-28 19:42 – Updated: 2026-10-28 19:42
VLAI
EPSS
VEX
Title
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
Summary
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.
Severity
5.3 (Medium)
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/labstack/echo/security/advisor… | x_refsource_CONFIRM |
| https://github.com/labstack/echo/commit/22e4b7110… | x_refsource_MISC |
| https://github.com/labstack/echo/releases/tag/v5.1.0 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 5.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:42:05.556Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq"
},
{
"name": "https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.1.0"
}
],
"source": {
"advisory": "GHSA-246p-cpwv-v3jq",
"discovery": "UNKNOWN"
},
"title": "Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118653",
"datePublished": "2026-10-28T19:42:05.556Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T19:42:05.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117656 (GCVE-0-2026-117656)
Vulnerability from cvelistv5 – Published: 2026-10-30 23:55 – Updated: 2026-10-30 23:55
VLAI
EPSS
VEX
Title
Unverified Sign in with Apple callback parameter can override verified ID token claims
Summary
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback.
Apple posts the user's name to the callback endpoint in a user form parameter that the browser submits and the client controls. Assent.Strategy.Apple.callback/2 in lib/assent/strategies/apple.ex decodes that parameter, and fetch_user/2 merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the user parameter can replace sub, email, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker's values.
This issue affects assent: from 0.1.25 before 0.3.2.
Severity
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/pow-auth/assent/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-117656.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-117656 | related |
| https://github.com/pow-auth/assent/commit/a2d331e… | related |
| https://github.com/pow-auth/assent/commit/18898bd… | patch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:pow-auth:assent:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Assent.Strategy.Apple\u0027"
],
"packageName": "assent",
"packageURL": "pkg:hex/assent",
"product": "assent",
"programFiles": [
"lib/assent/strategies/apple.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Assent.Strategy.Apple\u0027:callback/2"
},
{
"name": "\u0027Elixir.Assent.Strategy.Apple\u0027:fetch_user/2"
}
],
"repo": "https://github.com/pow-auth/assent",
"vendor": "pow-auth",
"versions": [
{
"lessThan": "0.3.2",
"status": "affected",
"version": "0.1.25",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:pow-auth:assent:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Assent.Strategy.Apple\u0027"
],
"packageName": "pow-auth/assent",
"packageURL": "pkg:github/pow-auth/assent",
"product": "assent",
"programFiles": [
"lib/assent/strategies/apple.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Assent.Strategy.Apple\u0027:callback/2"
},
{
"name": "\u0027Elixir.Assent.Strategy.Apple\u0027:fetch_user/2"
}
],
"repo": "https://github.com/pow-auth/assent",
"vendor": "pow-auth",
"versions": [
{
"lessThan": "18898bde0296152165ae470078490e5798329b1b",
"status": "affected",
"version": "a2d331e8c51376d6c0b04a81aad31e0b4d4d64a3",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pow-auth:assent:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.3.2",
"versionStartIncluding": "0.1.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Iain"
},
{
"lang": "en",
"type": "reporter",
"value": "Iain"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Schultzer"
},
{
"lang": "en",
"type": "remediation verifier",
"value": "Richard Ash"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-30T23:33:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAcceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the \u003ccode\u003euser\u003c/code\u003e parameter of the authorization callback.\u003c/p\u003e\n\u003cp\u003eApple posts the user\u0027s name to the callback endpoint in a \u003ccode\u003euser\u003c/code\u003e form parameter that the browser submits and the client controls. \u003ccode\u003eAssent.Strategy.Apple.callback/2\u003c/code\u003e in \u003ccode\u003elib/assent/strategies/apple.ex\u003c/code\u003e decodes that parameter, and \u003ccode\u003efetch_user/2\u003c/code\u003e merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the \u003ccode\u003euser\u003c/code\u003e parameter can replace \u003ccode\u003esub\u003c/code\u003e, \u003ccode\u003eemail\u003c/code\u003e, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker\u0027s values.\u003c/p\u003e\n\u003cp\u003eThis issue affects assent: from 0.1.25 before 0.3.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the `user` parameter of the authorization callback.\n\nApple posts the user\u0027s name to the callback endpoint in a `user` form parameter that the browser submits and the client controls. `Assent.Strategy.Apple.callback/2` in `lib/assent/strategies/apple.ex` decodes that parameter, and `fetch_user/2` merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the `user` parameter can replace `sub`, `email`, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker\u0027s values.\n\nThis issue affects assent: from 0.1.25 before 0.3.2."
}
],
"value": "Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback.\n\nApple posts the user\u0027s name to the callback endpoint in a user form parameter that the browser submits and the client controls. Assent.Strategy.Apple.callback/2 in lib/assent/strategies/apple.ex decodes that parameter, and fetch_user/2 merges it over the claims of the verified ID token, so the unverified map wins. An attacker who completes a Sign in with Apple login with their own Apple ID and edits the user parameter can replace sub, email, and any other claim. Applications that look up, link, or authorize accounts by the returned subject or email then act on the attacker\u0027s values.\n\nThis issue affects assent: from 0.1.25 before 0.3.2."
}
],
"impacts": [
{
"capecId": "CAPEC-22",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker with any Apple ID can sign in to an application that uses the Apple strategy as any other user whose Apple subject or email they know. Account lookup, account linking, and email-based access control then act on the attacker-chosen identity.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker with any Apple ID can sign in to an application that uses the Apple strategy as any other user whose Apple subject or email they know. Account lookup, account linking, and email-based access control then act on the attacker-chosen identity."
}
],
"value": "An attacker with any Apple ID can sign in to an application that uses the Apple strategy as any other user whose Apple subject or email they know. Account lookup, account linking, and email-based access control then act on the attacker-chosen identity."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-349",
"description": "CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T23:55:23.426Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Unverified Sign in with Apple callback parameter can override verified ID token claims",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/pow-auth/assent/security/advisories/GHSA-9fr5-g44g-9526"
},
{
"name": "EEF CNA record for CVE-2026-117656",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-117656.html"
},
{
"name": "OSV record EEF-CVE-2026-117656",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-117656"
},
{
"name": "Introducing commit a2d331e in pow-auth/assent",
"tags": [
"related"
],
"url": "https://github.com/pow-auth/assent/commit/a2d331e8c51376d6c0b04a81aad31e0b4d4d64a3"
},
{
"name": "Fix commit 18898bd in pow-auth/assent",
"tags": [
"patch"
],
"url": "https://github.com/pow-auth/assent/commit/18898bde0296152165ae470078490e5798329b1b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unverified Sign in with Apple callback parameter can override verified ID token claims",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRemove the \u003ccode\u003euser\u003c/code\u003e parameter from the callback parameters before you pass them to \u003ccode\u003eAssent.Strategy.Apple.callback/2\u003c/code\u003e, for example with \u003ccode\u003eMap.delete(params, \"user\")\u003c/code\u003e. Without the parameter, \u003ccode\u003edecode_user_params/2\u003c/code\u003e yields an empty map and the verified ID token claims pass through unchanged. The user\u0027s name is then unavailable, because Apple delivers it only through this parameter.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Remove the `user` parameter from the callback parameters before you pass them to `Assent.Strategy.Apple.callback/2`, for example with `Map.delete(params, \"user\")`. Without the parameter, `decode_user_params/2` yields an empty map and the verified ID token claims pass through unchanged. The user\u0027s name is then unavailable, because Apple delivers it only through this parameter."
}
],
"value": "Remove the user parameter from the callback parameters before you pass them to Assent.Strategy.Apple.callback/2, for example with Map.delete(params, \"user\"). Without the parameter, decode_user_params/2 yields an empty map and the verified ID token claims pass through unchanged. The user\u0027s name is then unavailable, because Apple delivers it only through this parameter."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart the Sign in with Apple flow of an application that uses \u003ccode\u003eAssent.Strategy.Apple\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAuthenticate at Apple with an Apple ID the attacker controls.\u003c/li\u003e\n\u003cli\u003eIntercept the \u003ccode\u003eform_post\u003c/code\u003e request to the application\u0027s callback URL and set the \u003ccode\u003euser\u003c/code\u003e parameter to a JSON object that carries the victim\u0027s values, such as \u003ccode\u003e{\"sub\": \"\u0026lt;victim subject\u0026gt;\", \"email\": \"victim@example.com\"}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application calls \u003ccode\u003eAssent.Strategy.Apple.callback/2\u003c/code\u003e. It validates the attacker\u0027s ID token and returns a user map whose \u003ccode\u003esub\u003c/code\u003e and \u003ccode\u003eemail\u003c/code\u003e are the victim\u0027s values, with \u003ccode\u003eemail_verified\u003c/code\u003e set to true.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start the Sign in with Apple flow of an application that uses `Assent.Strategy.Apple`.\n2. Authenticate at Apple with an Apple ID the attacker controls.\n3. Intercept the `form_post` request to the application\u0027s callback URL and set the `user` parameter to a JSON object that carries the victim\u0027s values, such as `{\"sub\": \"\u003cvictim subject\u003e\", \"email\": \"victim@example.com\"}`.\n4. The application calls `Assent.Strategy.Apple.callback/2`. It validates the attacker\u0027s ID token and returns a user map whose `sub` and `email` are the victim\u0027s values, with `email_verified` set to true."
}
],
"value": "* Start the Sign in with Apple flow of an application that uses Assent.Strategy.Apple.\n* Authenticate at Apple with an Apple ID the attacker controls.\n* Intercept the form_post request to the application\u0027s callback URL and set the user parameter to a JSON object that carries the victim\u0027s values, such as {\"sub\": \"\u003cvictim subject\u003e\", \"email\": \"victim@example.com\"}.\n* The application calls Assent.Strategy.Apple.callback/2. It validates the attacker\u0027s ID token and returns a user map whose sub and email are the victim\u0027s values, with email_verified set to true."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Unverified input.\u003c/strong\u003e Apple\u0027s \u003ccode\u003eform_post\u003c/code\u003e response mode delivers \u003ccode\u003ecode\u003c/code\u003e, \u003ccode\u003eid_token\u003c/code\u003e, \u003ccode\u003estate\u003c/code\u003e, and on the first authorization a \u003ccode\u003euser\u003c/code\u003e parameter that holds a JSON object with the user\u0027s name and email. The browser submits this parameter and Apple does not sign it, so the client controls its content.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Merge over verified claims.\u003c/strong\u003e \u003ccode\u003eAssent.Strategy.Apple.callback/2\u003c/code\u003e decodes the \u003ccode\u003euser\u003c/code\u003e parameter with \u003ccode\u003eHelpers.decode_json/2\u003c/code\u003e and stores the map in the config under \u003ccode\u003e:user\u003c/code\u003e. After \u003ccode\u003eAssent.Strategy.OIDC.fetch_user/2\u003c/code\u003e has validated the ID token, \u003ccode\u003eAssent.Strategy.Apple.fetch_user/2\u003c/code\u003e calls \u003ccode\u003eMap.merge/2\u003c/code\u003e with the verified claims first and the decoded parameter second. Keys from the parameter overwrite keys from the token, including \u003ccode\u003esub\u003c/code\u003e and \u003ccode\u003eemail\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Result.\u003c/strong\u003e \u003ccode\u003enormalize/2\u003c/code\u003e reads \u003ccode\u003esub\u003c/code\u003e and \u003ccode\u003eemail\u003c/code\u003e from the merged map and sets \u003ccode\u003eemail_verified\u003c/code\u003e to true, so the application receives attacker-chosen identity fields marked as verified.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Fix.\u003c/strong\u003e Version 0.3.2 ignores the parameter by default. With \u003ccode\u003einclude_unverified_name: true\u003c/code\u003e, only \u003ccode\u003egiven_name\u003c/code\u003e and \u003ccode\u003efamily_name\u003c/code\u003e are taken from it, and the verified claims are merged over them.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Unverified input.** Apple\u0027s `form_post` response mode delivers `code`, `id_token`, `state`, and on the first authorization a `user` parameter that holds a JSON object with the user\u0027s name and email. The browser submits this parameter and Apple does not sign it, so the client controls its content.\n\n**2. Merge over verified claims.** `Assent.Strategy.Apple.callback/2` decodes the `user` parameter with `Helpers.decode_json/2` and stores the map in the config under `:user`. After `Assent.Strategy.OIDC.fetch_user/2` has validated the ID token, `Assent.Strategy.Apple.fetch_user/2` calls `Map.merge/2` with the verified claims first and the decoded parameter second. Keys from the parameter overwrite keys from the token, including `sub` and `email`.\n\n**3. Result.** `normalize/2` reads `sub` and `email` from the merged map and sets `email_verified` to true, so the application receives attacker-chosen identity fields marked as verified.\n\n**4. Fix.** Version 0.3.2 ignores the parameter by default. With `include_unverified_name: true`, only `given_name` and `family_name` are taken from it, and the verified claims are merged over them."
}
],
"value": "1. Unverified input. Apple\u0027s form_post response mode delivers code, id_token, state, and on the first authorization a user parameter that holds a JSON object with the user\u0027s name and email. The browser submits this parameter and Apple does not sign it, so the client controls its content.\n\n2. Merge over verified claims. Assent.Strategy.Apple.callback/2 decodes the user parameter with Helpers.decode_json/2 and stores the map in the config under :user. After Assent.Strategy.OIDC.fetch_user/2 has validated the ID token, Assent.Strategy.Apple.fetch_user/2 calls Map.merge/2 with the verified claims first and the decoded parameter second. Keys from the parameter overwrite keys from the token, including sub and email.\n\n3. Result. normalize/2 reads sub and email from the merged map and sets email_verified to true, so the application receives attacker-chosen identity fields marked as verified.\n\n4. Fix. Version 0.3.2 ignores the parameter by default. With include_unverified_name: true, only given_name and family_name are taken from it, and the verified claims are merged over them."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-117656",
"datePublished": "2026-10-30T23:55:23.426Z",
"dateReserved": "2026-10-30T23:30:02.017Z",
"dateUpdated": "2026-10-30T23:55:23.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115962 (GCVE-0-2026-115962)
Vulnerability from cvelistv5 – Published: 2026-10-29 11:00 – Updated: 2026-10-29 12:36 X_Open Source
VLAI
EPSS
VEX
Title
WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability
Summary
Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:18 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Date Public
2026-10-27 10:31
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115962",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:18:03.748784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:36:51.694Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "mycred",
"product": "myCred",
"vendor": "myCred",
"versions": [
{
"changes": [
{
"at": "4.0.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MYUNGYONG LEE | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-27T10:31:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.\u003cp\u003eThis issue affects myCred: from n/a through 4.0.1.\u003c/p\u003e"
}
],
"value": "Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "Identity Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T11:00:25.822Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-1-bypass-vulnerability-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.2)."
}
],
"value": "Update the WordPress myCred plugin to the latest available version (at least 4.0.2)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress myCred plugin \u003c= 4.0.1 - Bypass Vulnerability vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-115962",
"datePublished": "2026-10-29T11:00:25.822Z",
"dateReserved": "2026-10-24T00:18:41.994Z",
"dateUpdated": "2026-10-29T12:36:51.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115933 (GCVE-0-2026-115933)
Vulnerability from cvelistv5 – Published: 2026-10-24 14:17 – Updated: 2026-10-24 14:29
VLAI
EPSS
VEX
Title
Forged signed tokens let any registered user take over other users and organizations
Summary
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.
A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Severity
9.9 (Critical)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/gitroomhq/postiz-app | product |
| https://github.com/gitroomhq/postiz-app/releases/… | release-notes |
| https://github.com/gitroomhq/postiz-app/commit/a5… | patch |
| https://gadvisory.org/advisories/PSA-2026-YT2HMH | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GitroomHQ | postiz-app |
Affected:
2.15.0 , < 2.25.3
(semver)
|
Date Public
2026-10-24 14:16
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "postiz-app",
"product": "postiz-app",
"repo": "https://github.com/gitroomhq/postiz-app",
"vendor": "GitroomHQ",
"versions": [
{
"lessThan": "2.25.3",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "The instance must be able to reach api2.skool.com, as any instance using the Skool provider can. No setting has to be changed."
},
{
"lang": "en",
"value": "With Stripe billing configured, the attacker\u0027s own plan must allow one channel and the target organization must not be on the STANDARD tier. The session and password reset tokens are not affected by these limits."
},
{
"lang": "en",
"value": "Self-registration is open unless DISABLE_REGISTRATION is set to true."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Anthropic, PBC"
},
{
"lang": "en",
"type": "coordinator",
"value": "Enno Gelhaus"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nevo David"
}
],
"datePublic": "2026-10-24T14:16:52.748Z",
"descriptions": [
{
"lang": "en",
"value": "Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way."
}
],
"exploits": [
{
"lang": "en",
"value": "Exploitation was demonstrated end to end against an unmodified backend build at commit 3a7d28b7ad96: a second self-registered user became super administrator of another user\u0027s organization and read its API key. Session, password reset, enterprise and subscription tokens obtained the same way were each accepted by their endpoints."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A registered user can obtain a validly signed token with claims of their choosing and use it as a login session for another user, without knowing any identifier of the victim when database filter objects are used as claims."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can join any other organization as super administrator, using an organization id that is exposed by any shared post preview link, read its API key and channel list and schedule posts through its connected social accounts."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can reset the password of a user whose id they know, and can obtain an organization with a lifetime top-tier subscription through the enterprise provisioning endpoint."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Forged tokens do not expire and cannot be told apart from genuine ones."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "The narrower invitation route lets a user who may invite team members repeatedly stop the scheduled posts of a channel of another organization, and lift the channel limit of their own plan."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-345",
"description": "CWE-345",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:29:17.141Z",
"orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"shortName": "postiz"
},
"references": [
{
"name": "Postiz",
"tags": [
"product"
],
"url": "https://github.com/gitroomhq/postiz-app"
},
{
"name": "v2.25.3",
"tags": [
"release-notes"
],
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3"
},
{
"name": "a5affe62",
"tags": [
"patch"
],
"url": "https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c"
},
{
"name": "GAdvisory",
"tags": [
"vendor-advisory"
],
"url": "https://gadvisory.org/advisories/PSA-2026-YT2HMH"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T17:45:00.000Z",
"value": "Anthropic has disclosed a thorough report of this vulnerability including a working PoC to Postiz"
},
{
"lang": "en",
"time": "2026-10-23T18:00:00.000Z",
"value": "Postiz has reproduced the vulnerability and is working on a fix"
},
{
"lang": "en",
"time": "2026-10-24T13:27:00.000Z",
"value": "Postiz has pushed a fix for this vulnerability and verified it"
},
{
"lang": "en",
"time": "2026-10-24T14:18:00.000Z",
"value": "Postiz has created a release and published the advisory"
}
],
"title": "Forged signed tokens let any registered user take over other users and organizations",
"workarounds": [
{
"lang": "en",
"value": "If you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains."
},
{
"lang": "en",
"value": "Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"assignerShortName": "postiz",
"cveId": "CVE-2026-115933",
"datePublished": "2026-10-24T14:17:05.755Z",
"dateReserved": "2026-10-23T21:21:06.893Z",
"dateUpdated": "2026-10-24T14:29:17.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114640 (GCVE-0-2026-114640)
Vulnerability from cvelistv5 – Published: 2026-10-22 01:43 – Updated: 2026-10-28 02:14
VLAI
EPSS
VEX
Title
Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
Summary
Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 02:14 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/traefik/traefik/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/traefik-3.7.… | third-party-advisory |
Impacted products
Date Public
2026-10-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114640",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T02:14:14.441251Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:14:25.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v3",
"product": "traefik",
"vendor": "traefik",
"versions": [
{
"lessThan": "3.7.14",
"status": "affected",
"version": "3.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.14",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.7.14",
"versionStartIncluding": "3.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "finder",
"value": "skigeek16"
},
{
"lang": "en",
"type": "finder",
"value": "opensec-intelligence"
}
],
"datePublic": "2026-10-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen certificate subject and issuer to impersonate mTLS identities."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T01:43:39.899Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mwrr-6hp4-pxr6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6"
},
{
"name": "VulnCheck Advisory: Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/traefik-3.7.0-before-3.7.14-mtls-header-spoofing-via-ingress-nginx-http-router"
}
],
"title": "Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114640",
"datePublished": "2026-10-22T01:43:39.899Z",
"dateReserved": "2026-10-21T21:57:36.197Z",
"dateUpdated": "2026-10-28T02:14:25.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113703 (GCVE-0-2026-113703)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:56 – Updated: 2026-10-23 13:28 X_Open Source
VLAI
EPSS
VEX
Title
SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
Summary
SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.
Severity
9.3 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:18 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/giuseppe99barchetta/SuggestArr… | release-notespatch |
| https://github.com/giuseppe99barchetta/SuggestArr… | vendor-advisory |
| https://www.vulncheck.com/advisories/suggestarr-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| giuseppe99barchetta | SuggestArr |
Affected:
1.0.4 , < 3.0.0
(semver)
cpe:2.3:a:giuseppe99barchetta:suggestarr:*:*:*:*:*:*:*:* |
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113703",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:18:19.240308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:18:36.636Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/giuseppe99barchetta/SuggestArr",
"product": "SuggestArr",
"repo": "https://github.com/giuseppe99barchetta/SuggestArr",
"vendor": "giuseppe99barchetta",
"versions": [
{
"lessThan": "3.0.0",
"status": "affected",
"version": "1.0.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:giuseppe99barchetta:suggestarr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.0",
"versionStartIncluding": "1.0.4",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Komiljon Ayubov"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:28:34.182Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "SuggestArr v3.0.0 Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/giuseppe99barchetta/SuggestArr/releases/tag/v3.0.0"
},
{
"name": "GitHub Security Advisory (GHSA-fcjm-xhw8-pmh5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5"
},
{
"name": "VulnCheck Advisory: SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/suggestarr-before-authentication-bypass-via-x-forwarded-for-spoofing"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113703",
"datePublished": "2026-10-20T15:56:49.963Z",
"dateReserved": "2026-10-20T15:50:59.510Z",
"dateUpdated": "2026-10-23T13:28:34.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112241 (GCVE-0-2026-112241)
Vulnerability from cvelistv5 – Published: 2026-10-22 08:00 – Updated: 2026-10-22 10:56 X_Open Source
VLAI
EPSS
VEX
Title
WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability
Summary
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 10:48 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Brainstorm Force | SureCart |
Affected:
0 , ≤ 4.9.5
(custom)
|
Date Public
2026-10-20 07:03
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112241",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T10:48:22.478986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:56:14.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "surecart",
"product": "SureCart",
"vendor": "Brainstorm Force",
"versions": [
{
"changes": [
{
"at": "4.9.6",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.9.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deva Parekh | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-20T07:03:13.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.\u003cp\u003eThis issue affects SureCart: from n/a through 4.9.5.\u003c/p\u003e"
}
],
"value": "Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T08:00:49.628Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/surecart/vulnerability/wordpress-surecart-plugin-4-9-5-broken-authentication-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress SureCart plugin to the latest available version (at least 4.9.6)."
}
],
"value": "Update the WordPress SureCart plugin to the latest available version (at least 4.9.6)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress SureCart plugin \u003c= 4.9.5 - Broken Authentication vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-112241",
"datePublished": "2026-10-22T08:00:49.628Z",
"dateReserved": "2026-10-19T11:33:40.352Z",
"dateUpdated": "2026-10-22T10:56:14.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111691 (GCVE-0-2026-111691)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 21:17
VLAI
EPSS
VEX
Title
WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header
Summary
WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 20:51 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x… | third-party-advisory |
| https://github.com/wimoor-erp/wimoor/blob/ec86736… | technical-description |
| https://www.vulncheck.com/advisories/wimoor-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wimoor-erp | wimoor |
Affected:
0 , ≤ ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4
(git)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111691",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T20:51:57.554871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T21:17:17.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wimoor-erp/wimoor",
"product": "wimoor",
"repo": "https://github.com/wimoor-erp/wimoor",
"vendor": "wimoor-erp",
"versions": [
{
"lessThanOrEqual": "ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants\u0027 orders, finance data, and Amazon seller authorizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:47.608Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/wimoor-trusted-x-userinfo-header-tenant-bypass"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wimoor-erp/wimoor/blob/ec86736beb1a3b9ca6ba0d1c48a1c415445b8dc4/wimoor-common/common-mvc/src/main/java/com/wimoor/common/mvc/filter/UserInfoFilter.java#L42-L51"
},
{
"name": "VulnCheck Advisory: WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wimoor-through-commit-ec86736-authentication-bypass-via-forged-x-userinfo-header"
}
],
"title": "WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111691",
"datePublished": "2026-10-16T17:39:47.608Z",
"dateReserved": "2026-10-16T14:31:20.461Z",
"dateUpdated": "2026-10-16T21:17:17.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-21: Exploitation of Trusted Identifiers
An adversary guesses, obtains, or "rides" a trusted identifier (e.g. session ID, resource ID, cookie, etc.) to perform authorized actions under the guise of an authenticated user or service.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-461: Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
An adversary utilizes a hash function extension/padding weakness, to modify the parameters passed to the web service requesting authentication by generating their own call in order to generate a legitimate signature hash (as described in the notes), without knowledge of the secret token sometimes provided by the web service.
CAPEC-473: Signature Spoof
An attacker generates a message or datablock that causes the recipient to believe that the message or datablock was generated and cryptographically signed by an authoritative or reputable source, misleading a victim or victim operating system into performing malicious actions.
CAPEC-476: Signature Spoofing by Misrepresentation
An attacker exploits a weakness in the parsing or display code of the recipient software to generate a data blob containing a supposedly valid signature, but the signer's identity is falsely represented, which can lead to the attacker manipulating the recipient software or its victim user to perform compromising actions.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-667: Bluetooth Impersonation AttackS (BIAS)
An adversary disguises the MAC address of their Bluetooth enabled device to one for which there exists an active and trusted connection and authenticates successfully. The adversary can then perform malicious actions on the target Bluetooth device depending on the target’s capabilities.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.