CWE-304

{
  "affected": [],
  "aliases": [
    "CVE-2024-9216"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-20T10:15:47Z",
    "severity": "HIGH"
  },
  "details": "An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users\u0027 chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure source like a cookie. This allows an attacker to pass another user\u0027s username to the get_model function, thereby gaining unauthorized access to that user\u0027s chat history.",
  "id": "GHSA-g3p7-f346-26m6",
  "modified": "2025-03-20T12:32:50Z",
  "published": "2025-03-20T12:32:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9216"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/21e54c3f-e2d7-423b-9890-1f0cb99af4dd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ray"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.52.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-34351"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-304"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-01T20:51:10Z",
    "nvd_published_at": "2025-11-27T03:15:58Z",
    "severity": "CRITICAL"
  },
  "details": "Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.",
  "id": "GHSA-gx77-xgc2-4888",
  "modified": "2025-12-01T20:51:10Z",
  "published": "2025-11-27T03:30:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-w8vc-465m-jjw6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34351"
    },
    {
      "type": "WEB",
      "url": "https://docs.ray.io/en/latest/ray-security/token-auth.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ray-project/ray"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ray-project/ray/releases/tag/ray-2.52.0"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/resourcessupport/allresources/cnarules#section_4-1_Vulnerability_Determination"
    },
    {
      "type": "WEB",
      "url": "https://www.linkedin.com/posts/jonathan-leitschuh_the-latest-piece-of-mind-bending-research-activity-7396976425997606912-qizE"
    },
    {
      "type": "WEB",
      "url": "https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet"
    },
    {
      "type": "WEB",
      "url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/anyscale-ray-token-authentication-disabled-by-default-insecure-configuration"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ray\u0027s New Token Authentication is Disabled By Default"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-76207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T14:17:46Z",
    "severity": "HIGH"
  },
  "details": "phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.",
  "id": "GHSA-jvxm-3fc5-8pjr",
  "modified": "2026-08-19T15:32:31Z",
  "published": "2026-08-19T15:32:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hvj7-4fmg-53cr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76207"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/phpmyfaq-before-2fa-bypass-via-remember-me-cookie"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-54391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T22:17:10Z",
    "severity": "CRITICAL"
  },
  "details": "Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.",
  "id": "GHSA-m457-grcf-698x",
  "modified": "2026-09-03T15:32:08Z",
  "published": "2026-09-02T00:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54391"
    },
    {
      "type": "WEB",
      "url": "https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022"
    },
    {
      "type": "WEB",
      "url": "https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=0f3d14d6be4d9f23e511701696a529ef3b7ffd61"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "devpi-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.20.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54723"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T20:41:21Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIf the replication protocol is enabled by using the ``primary`` (or deprecated ``master``) role for a server instance, then the ``+changelog`` URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from ``devpi-tokens`` by using a trivially modified GET request.\n\nThe leaked hashes use the ``argon2`` algorithm, so they are not immediately at risk by brute-force methods, but dictionary attacks are feasible. If a database leak could have happened, it is advised to change the passwords after a patched version or other mitigation is in place.\n\nWhen ``devpi-tokens`` is in use, the quality of the server secret is important. It might be possible to derive the server secret if actual tokens are public by using similar techniques to finding the password for a hash. If a database leak could have happened and any tokens are public, it is advised to change the server secret.\n\nBesides the information leak this can be used to produce significant CPU, IO and bandwidth usage depending on the database size.\n\n### Patches\n\nThe logic bug causing this issue is fixed with devpi-server 6.20.2 and devpi-server 7.0.0b3.\n\n### Workarounds\n\nWhen replication isn\u0027t used the role can explicitly be set to ``standalone``.\n\nIf the server instance is exclusively served through ``nginx`` with the ``devpi-lockdown`` plugin, the request is redirected to the login form due to missing user information. There is no known exploit in this case.",
  "id": "GHSA-m5pq-69xg-vcq3",
  "modified": "2026-08-18T20:41:22Z",
  "published": "2026-08-18T20:41:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/devpi/devpi/security/advisories/GHSA-m5pq-69xg-vcq3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/devpi/devpi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "devpi-server may leak database contents"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-12048"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304",
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-20T10:15:26Z",
    "severity": "HIGH"
  },
  "details": "An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users\u0027 information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.",
  "id": "GHSA-m74w-gj86-32q9",
  "modified": "2025-03-20T12:32:42Z",
  "published": "2025-03-20T12:32:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12048"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52424"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-17T21:15:07Z",
    "severity": "HIGH"
  },
  "details": "The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an \"SSID Confusion\" issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.",
  "id": "GHSA-mh3c-527f-cwqv",
  "modified": "2024-08-29T21:31:02Z",
  "published": "2024-05-17T21:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52424"
    },
    {
      "type": "WEB",
      "url": "https://mentor.ieee.org/802.11/dcn/24/11-24-0938-03-000m-protect-ssid-in-4-way-handshake.docx"
    },
    {
      "type": "WEB",
      "url": "https://www.top10vpn.com/assets/2024/05/Top10VPN-x-Vanhoef-SSID-Confusion.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.top10vpn.com/research/wifi-vulnerability-ssid"
    },
    {
      "type": "WEB",
      "url": "https://www.wi-fi.org/news-events/press-releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-61466"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-06T12:16:27Z",
    "severity": "CRITICAL"
  },
  "details": "In Apache CXF\u0027s OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.",
  "id": "GHSA-pwwh-3685-58r7",
  "modified": "2026-08-07T00:31:10Z",
  "published": "2026-08-06T12:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61466"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2l1r16g79tpxd7fzrzr2q9oscwrjgljs"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/06/21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-93994"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-30T10:17:17Z",
    "severity": "HIGH"
  },
  "details": "Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods \"publickey,publickey\". Apache MINA SSHD provides an equivalent configuration mechanism.\n\n\n\n\nIn Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.\n\n\n\n\n\n\nUsers are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.",
  "id": "GHSA-qc4p-9828-mv83",
  "modified": "2026-09-30T12:35:16Z",
  "published": "2026-09-30T12:35:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93994"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/29/33"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-100667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-26T14:16:50Z",
    "severity": "MODERATE"
  },
  "details": "grav-plugin-login (the Grav CMS Login plugin) versions \u003e= 3.8.7 and \u003c 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session sitting at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member\u0027s password but cannot answer that member\u0027s second factor can therefore read member-only content rendered by the no-argument authenticated() or group authenticated(null, \u0027group\u0027) forms and by [authenticated]; the inverse [guest] shortcode is likewise evaluated too early. Impact is limited to disclosure of that content: the attacker does not obtain a completed session, cannot access pages protected by an access: rule, and cannot act as the user. The authenticated(\u0027some.permission\u0027) form, which goes through UserObject::authorize(), is not affected. Fixed in grav-plugin-login 3.9.7.",
  "id": "GHSA-r29m-xqx4-rwgf",
  "modified": "2026-09-26T15:31:19Z",
  "published": "2026-09-26T15:31:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-636m-8598-45r9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100667"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-plugin-login-3.8.7-through-3.9.6-two-factor-authentication-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}