Common Weakness Enumeration

CWE-288

Weakness Allowed

Authentication Bypass Using an Alternate Path or Channel

Abstraction: Base · Status: Incomplete

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-306 · View CWE-1000

ChildOf: CWE-284 · View CWE-1340

PeerOf: CWE-420 (symmetric) · View CWE-1000

Modes of introduction

Architecture and Design

COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Architecture and Design

This is often seen in web applications that assume that access to a particular CGI program can only be obtained through a "front" screen, when the supporting programs are directly accessible. But this problem is not just in web apps.

Notes

Relationship

overlaps Unprotected Alternate Channel

Content history

Submission: PLOVER · 2006-07-19 · CWE Draft 3

Contribution: Abhi Balakrishnan · 2024-09-29 · CWE 4.16

Contributed usability diagram concepts used by the CWE team

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Description, Modes_of_Introduction, Name, Relationships, Observed_Example, Relationship_Notes, Taxonomy_Mappings, Type

Modification: CWE Content Team · MITRE · 2008-11-24 · CWE 1.1

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2011-03-29 · CWE 1.12

updated Relationships

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Observed_Examples, Related_Attack_Patterns, Relationships

Modification: CWE Content Team · MITRE · 2012-10-30 · CWE 2.3

updated Potential_Mitigations

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships

Modification: CWE Content Team · MITRE · 2017-05-03 · CWE 2.11

updated Related_Attack_Patterns, Relationships

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Applicable_Platforms, Modes_of_Introduction, Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Relationships

Modification: CWE Content Team · MITRE · 2020-12-10 · CWE 4.3

updated Relationships

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Related_Attack_Patterns

Modification: CWE Content Team · MITRE · 2021-10-28 · CWE 4.6

updated Relationships

Modification: CWE Content Team · MITRE · 2022-10-13 · CWE 4.9

updated Relationships

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes, Relationships

Modification: CWE Content Team · MITRE · 2023-10-26 · CWE 4.13

updated Demonstrative_Examples

Modification: CWE Content Team · MITRE · 2024-11-19 · CWE 4.16

updated Description, Diagram

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Relationships, Weakness_Ordinalities

1345 vulnerabilities reference this CWE, most recent first.

CVE-2026-123746 (GCVE-0-2026-123746)

Vulnerability from cvelistv5 – Published: 2026-11-06 12:36 – Updated: 2026-11-06 12:36

Title

Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

Summary

The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. AuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle’s Security::login() to authenticate a user programmatically, but it does not dispatch the security.authentication.success event, on which checkPostAuth() runs. The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth() is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically. Applications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link. A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected. The fix makes AuthenticatorManager::authenticateUser() dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-288 - Authentication bypass using an alternate path or channel

Assigner

Checkmarx CNA under the mitre root

CNA scorecard B 88/100 over 23 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/symfony/symfony/security/advis…	third-party-advisory
https://github.com/symfony/symfony/commit/af0aae5…	patch

Impacted products

1 product

Vendor	Product	Version
sensiolabs	symfony	Affected: 0 , < 5.4.56 (git) Affected: 6.0.0 , < 6.4.50 (git) Affected: 7.0.0 , < 7.4.23 (git) Affected: 8.0.0 , < 8.1.11 (git) cpe:2.3:a:sensiolabs:symfony:::::::: cpe:2.3:a:sensiolabs:symfony:::::::: cpe:2.3:a:sensiolabs:symfony:::::::: cpe:2.3:a:sensiolabs:symfony::::::::

Credits

Nicolas Grekas Vincent Cassiau from CyberVanguard

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/packages/symfony/security-http",
          "defaultStatus": "unaffected",
          "modules": [
            "Symfony\\Component\\Security\\Http\\Authentication\\AuthenticatorManager"
          ],
          "packageName": "symfony/security-http",
          "product": "symfony",
          "repo": "https://github.com/symfony/security-http",
          "vendor": "sensiolabs",
          "versions": [
            {
              "lessThan": "5.4.56",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            },
            {
              "lessThan": "6.4.50",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "7.4.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.56",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.50",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4.23",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.1.11",
                  "versionStartIncluding": "8.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nicolas Grekas"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Vincent Cassiau from CyberVanguard"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eThe Symfony Security HTTP component\u0026nbsp;\u003c/span\u003e\u003ccode\u003eAuthenticatorManager::authenticateUser()\u003c/code\u003e\u003cspan\u003e does not run the firewall user checker\u2019s \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in\u003c/span\u003e\u0026nbsp;Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/p\u003e\u003cp\u003e\u003ccode\u003eAuthenticatorManager::authenticateUser()\u003c/code\u003e is used by \u003ccode\u003eUserAuthenticatorInterface::authenticateUser()\u003c/code\u003e and by the SecurityBundle\u2019s \u003ccode\u003eSecurity::login()\u003c/code\u003e to authenticate a user programmatically, but it\u0026nbsp;does not dispatch the \u003ccode\u003esecurity.authentication.success\u003c/code\u003e event, on which \u003ccode\u003echeckPostAuth()\u003c/code\u003e runs.\u0026nbsp;\u003cspan\u003eThe fix for CVE-2024-50341 made \u003c/span\u003e\u003ccode\u003eSecurity::login()\u003c/code\u003e\u003cspan\u003e call \u003c/span\u003e\u003ccode\u003echeckPreAuth()\u003c/code\u003e\u003cspan\u003e, but \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e was still skipped. As a result, an account rejected by a custom user checker in \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e\u0026nbsp;is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eApplications are affected when they use a custom user checker that rejects users in \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e and authenticate users programmatically, for example after a password reset or an e-mail verification link.\u0026nbsp;\u003c/span\u003eA user whose account is rejected can then obtain an authenticated session through that flow\u003cspan\u003e. The default user checker does nothing in \u003c/span\u003e\u003ccode\u003echeckPostAuth()\u003c/code\u003e\u003cspan\u003e, so the default configuration is not affected.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eThe fix makes\u0026nbsp;\u003ccode\u003eAuthenticatorManager::authenticateUser()\u003c/code\u003e\u0026nbsp;dispatch the \u003ccode\u003esecurity.authentication.success\u003c/code\u003e event once the token is created and before it is stored, as authentications through the firewall do, so that \u003ccode\u003echeckPostAuth()\u003c/code\u003e runs and can reject the user.\u003c/p\u003e"
            }
          ],
          "value": "The Symfony Security HTTP component\u00a0AuthenticatorManager::authenticateUser() does not run the firewall user checker\u2019s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in\u00a0Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\nAuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle\u2019s Security::login() to authenticate a user programmatically, but it\u00a0does not dispatch the security.authentication.success event, on which checkPostAuth() runs.\u00a0The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth()\u00a0is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically.\n\n\n\nApplications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link.\u00a0A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected.\n\n\n\nThe fix makes\u00a0AuthenticatorManager::authenticateUser()\u00a0dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication bypass using an alternate path or channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T12:36:50.994Z",
        "orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
        "shortName": "Checkmarx"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/symfony/symfony/security/advisories/GHSA-8f57-m8wj-x65w"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/symfony/symfony/commit/af0aae5012beedf0a0c3fd581fd8b9ef696240c4"
        }
      ],
      "source": {
        "advisory": "GHSA-8f57-m8wj-x65w",
        "discovery": "UNKNOWN"
      },
      "title": "Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
    "assignerShortName": "Checkmarx",
    "cveId": "CVE-2026-123746",
    "datePublished": "2026-11-06T12:36:50.994Z",
    "dateReserved": "2026-11-06T12:28:14.998Z",
    "dateUpdated": "2026-11-06T12:36:50.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-123618 (GCVE-0-2026-123618)

Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-06 15:00

Title

ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

Summary

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/abpframework/abp/pull/26305	issue-trackingpatch
https://github.com/abpframework/abp/commit/59b04c…	patch
https://github.com/abpframework/abp	product
https://github.com/abpframework/abp/commit/b2fd3c…	patch
https://github.com/abpframework/abp/releases/tag/10.7.1	release-notes
https://github.com/abpframework/abp/blob/10.7.0/m…	technical-description
https://www.vulncheck.com/advisories/abp-framewor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
abpframework	abp	Affected: 0 , < 10.7.1 (semver)

Date Public

2026-10-20 00:00

Credits

Nguyen Le Thanh Nam (yuwkaa) maliming

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:nuget/Volo.Abp.OpenIddict.AspNetCore",
          "product": "abp",
          "vendor": "abpframework",
          "versions": [
            {
              "lessThan": "10.7.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nguyen Le Thanh Nam (yuwkaa)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "maliming"
        }
      ],
      "datePublic": "2026-10-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T15:00:54.268Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request #26305",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/abpframework/abp/pull/26305"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/abpframework/abp/commit/59b04c48dddbf79c58a65808400b4ed11f902ef1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/abpframework/abp"
        },
        {
          "name": "Fix commit b2fd3cf",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/abpframework/abp/commit/b2fd3cf049c69e585fb621049fde55349865d132"
        },
        {
          "name": "abp 10.7.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/abpframework/abp/releases/tag/10.7.1"
        },
        {
          "name": "Password grant external-provider branch",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/abpframework/abp/blob/10.7.0/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs#L52-L77"
        },
        {
          "name": "VulnCheck Advisory: ABP Framework before 10.7.1 Authentication Bypass via External Login Provider",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/abp-framework-before-10.7.1-authentication-bypass-via-external-login-provider"
        }
      ],
      "title": "ABP Framework before 10.7.1 Authentication Bypass via External Login Provider",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-123618",
    "datePublished": "2026-11-06T15:00:54.268Z",
    "dateReserved": "2026-11-06T01:04:42.201Z",
    "dateUpdated": "2026-11-06T15:00:54.268Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119420 (GCVE-0-2026-119420)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-11-05 21:14

Title

Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Summary

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 21:14 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/getlago/lago-api/commit/5a9d59…	patch
https://github.com/getlago/lago-api/pull/6146	issue-trackingpatch
https://github.com/getlago/lago-api/blob/v1.55.0/…	technical-description
https://github.com/getlago/lago-api/blob/v1.55.0/…	technical-description
https://abraxaslabs.tech/research/lago-invite-ato	third-party-advisory
https://github.com/getlago/lago-api	product
https://www.vulncheck.com/advisories/lago-through…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
getlago	lago	Affected: 0 , ≤ 1.55.0 (semver)

Date Public

2026-08-13 00:00

Credits

Abraxas Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119420",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T21:14:22.634773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T21:14:44.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://abraxaslabs.tech/research/lago-invite-ato"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "lago",
          "repo": "https://github.com/getlago/lago-api",
          "vendor": "getlago",
          "versions": [
            {
              "lessThanOrEqual": "1.55.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim\u0027s email, accept with an arbitrary password, and receive a JWT to access the victim\u0027s organizations, billing data, API keys and payment integrations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:51.565Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/getlago/lago-api/pull/6146"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L15-L16"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/lago-invite-ato"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/getlago/lago-api"
        },
        {
          "name": "VulnCheck Advisory: Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/lago-through-1.55.0-authentication-bypass-via-acceptinvite-graphql-mutation"
        }
      ],
      "title": "Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119420",
    "datePublished": "2026-10-30T11:30:51.565Z",
    "dateReserved": "2026-10-30T02:41:12.203Z",
    "dateUpdated": "2026-11-05T21:14:44.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118681 (GCVE-0-2026-118681)

Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-11-03 13:22

Title

go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware

Summary

go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-03 13:21 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7427 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/go-chi/chi/security/advisories…	vendor-advisory
https://www.vulncheck.com/advisories/go-chi-chi-b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
go-chi	chi	Affected: 0 , < 5.5.0 (semver) Unaffected: 5.5.0 (semver)

Date Public

2026-10-14 00:00

Credits

dpfkdlemtp

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118681",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T13:21:58.146303Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T13:22:44.537Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/go-chi/chi/v5",
          "product": "chi",
          "vendor": "go-chi",
          "versions": [
            {
              "lessThan": "5.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "dpfkdlemtp"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router\u0027s parameter and child suffix in place for dispatch against the outer router. Unauthenticated attackers can request a mounted path whose suffix matches an outer public route, skipping the mounted authentication middleware and retrieving tenant-scoped data when that outer handler trusts the retained mount parameter."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T18:59:52.523Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rqrp-8cg2-5958)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-chi/chi/security/advisories/GHSA-rqrp-8cg2-5958"
        },
        {
          "name": "VulnCheck Advisory: go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/go-chi-chi-before-5.5.0-authentication-bypass-via-supressnotfound-middleware"
        }
      ],
      "title": "go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-118681",
    "datePublished": "2026-10-28T18:59:52.523Z",
    "dateReserved": "2026-10-28T17:28:46.441Z",
    "dateUpdated": "2026-11-03T13:22:44.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118582 (GCVE-0-2026-118582)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:08 – Updated: 2026-11-06 13:46

Title

CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 13:46 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 281 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-281

Impacted products

1 product

Vendor	Product	Version
Drupal	CAPTCHA	Affected: 0.0.0 , < 1.18.0 (semver) Affected: 2.0.0 , < 2.0.11 (semver)

Date Public

2026-10-28 17:27

Credits

James Gilliland (neclimdul) Rodrigo Cabo (rodrigo-cabo) Jakob P (japerry) James Gilliland (neclimdul) Rob Loach (robloach) Swan Kalata (akalata) Bram Driesen (bramdriesen) Damien McKenna (damienmckenna) Michael Hess (mlhess) Juraj Nemec (poker10) Pierre Rudloff (prudloff) Stella Power (stella) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T13:46:36.586306Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T13:46:40.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/captcha",
          "product": "CAPTCHA",
          "repo": "https://git.drupalcode.org/project/captcha",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.0.11",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Rodrigo Cabo (rodrigo-cabo)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jakob P (japerry)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Rob Loach (robloach)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Bram Driesen (bramdriesen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Michael Hess (mlhess)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Stella Power (stella)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T17:27:47.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:46.618Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-281"
        }
      ],
      "title": "CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118582",
    "datePublished": "2026-10-30T03:08:46.618Z",
    "dateReserved": "2026-10-28T16:08:24.142Z",
    "dateUpdated": "2026-11-06T13:46:40.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118572 (GCVE-0-2026-118572)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:08 – Updated: 2026-11-06 12:41

Title

OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 12:39 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 281 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-284

Impacted products

1 product

Vendor	Product	Version
Drupal	OAuth Login - OAuth OIDC SSO	Affected: 0.0.0 , < 3.1.1 (semver)

Date Public

2026-10-28 17:35

Credits

Sanjeev Kumar (ksanjeev284) Akash khairnar (khairnarakash) Neetu Choudhary (neetu01) purva_shende Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118572",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T12:39:14.531882Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T12:41:54.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/oauth_login_oauth2",
          "product": "OAuth Login - OAuth OIDC SSO",
          "repo": "https://git.drupalcode.org/project/oauth_login_oauth2",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.1.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjeev Kumar (ksanjeev284)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Akash khairnar (khairnarakash)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Neetu Choudhary (neetu01)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "purva_shende"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T17:35:17.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:41.455Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-284"
        }
      ],
      "title": "OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118572",
    "datePublished": "2026-10-30T03:08:41.455Z",
    "dateReserved": "2026-10-28T15:50:46.720Z",
    "dateUpdated": "2026-11-06T12:41:54.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118554 (GCVE-0-2026-118554)

Vulnerability from cvelistv5 – Published: 2026-10-30 03:08 – Updated: 2026-11-06 12:25

Title

OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 12:25 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

drupal CNA under the mitre root

CNA scorecard D 53/100 over 281 records in the last 180 days details

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-287

Impacted products

1 product

Vendor	Product	Version
Drupal	OpenID Connect Client	Affected: 0.0.0 , < 2.3.1 (semver)

Date Public

2026-10-28 17:37

Credits

Sanjeev Kumar (ksanjeev284) Matthijs Van Assche (matthijs) Swan Kalata (akalata) Greg Knaddison (greggles) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-118554",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T12:25:18.180605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T12:25:58.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/oidc",
          "product": "OpenID Connect Client",
          "repo": "https://git.drupalcode.org/project/oidc",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.3.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjeev Kumar (ksanjeev284)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matthijs Van Assche (matthijs)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-10-28T17:37:54.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:38.343Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-287"
        }
      ],
      "title": "OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118554",
    "datePublished": "2026-10-30T03:08:38.343Z",
    "dateReserved": "2026-10-28T15:50:46.718Z",
    "dateUpdated": "2026-11-06T12:25:58.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116606 (GCVE-0-2026-116606)

Vulnerability from cvelistv5 – Published: 2026-11-02 12:59 – Updated: 2026-11-03 04:55

Title

Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway

Summary

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 00:00 UTC

CWE

CWE-288 - Authentication bypass using an alternate path or channel

Assigner

Mandiant CNA under the Google root

CNA scorecard B 80/100 over 19 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/mandiant/Vulnerability-Disclos…	third-party-advisory
https://trust.barracuda.com/security/pre-authenti…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Barracuda Networks	Barracuda Email Security Gateway (ESG)	Affected: 0 , < 9.4.0.030 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T04:55:19.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Barracuda Email Security Gateway (ESG)",
          "vendor": "Barracuda Networks",
          "versions": [
            {
              "lessThan": "9.4.0.030",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance\u2019s global configuration."
            }
          ],
          "value": "An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance\u2019s global configuration."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication bypass using an alternate path or channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T12:59:11.278Z",
        "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "shortName": "Mandiant"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0042.md"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
    "assignerShortName": "Mandiant",
    "cveId": "CVE-2026-116606",
    "datePublished": "2026-11-02T12:59:11.278Z",
    "dateReserved": "2026-10-26T16:04:54.772Z",
    "dateUpdated": "2026-11-03T04:55:19.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115829 (GCVE-0-2026-115829)

Vulnerability from cvelistv5 – Published: 2026-10-30 19:47 – Updated: 2026-11-05 17:58

Title

Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force

Summary

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.

Severity

9.9 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 19:56 UTC

CWE

CWE-288 - Authentication bypass using an alternate path or channel

Assigner

Delinea CNA under the mitre root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://delinea.com/security-advisories

Impacted products

1 product

Vendor	Product	Version
Delinea	Secret Server (On-Prem)	Affected: older versions , ≤ 12.2.7 (custom)

Credits

Aidan Stansfield - Division 5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115829",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T19:56:41.493585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T19:57:00.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secret Server (On-Prem)",
          "vendor": "Delinea",
          "versions": [
            {
              "lessThanOrEqual": "12.2.7",
              "status": "affected",
              "version": "older versions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aidan Stansfield - Division 5"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone."
            }
          ],
          "value": "In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication bypass using an alternate path or channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T17:58:16.934Z",
        "orgId": "1443cd92-d354-46d2-9290-d812316ca43a",
        "shortName": "Delinea"
      },
      "references": [
        {
          "url": "https://delinea.com/security-advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to Secret Server on-prem version 12.3.1"
            }
          ],
          "value": "Upgrade to Secret Server on-prem version 12.3.1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1443cd92-d354-46d2-9290-d812316ca43a",
    "assignerShortName": "Delinea",
    "cveId": "CVE-2026-115829",
    "datePublished": "2026-10-30T19:47:31.936Z",
    "dateReserved": "2026-10-23T16:54:29.983Z",
    "dateUpdated": "2026-11-05T17:58:16.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114732 (GCVE-0-2026-114732)

Vulnerability from cvelistv5 – Published: 2026-10-22 02:16 – Updated: 2026-10-29 10:57

Summary

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 10:53 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2230 records in the last 180 days details

References

6 references

URL	Tags
https://bugs.debian.org/1151279	issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit…	patch
https://roundcube.net/news/2026/10/19/security-up…	vendor-advisoryrelease-notes
https://github.com/roundcube/roundcubemail/releas…	release-notespatch
https://github.com/roundcube/roundcubemail/releas…	release-notespatch
https://github.com/roundcube/roundcubemail/commit…	patch

Impacted products

1 product

Vendor	Product	Version
Roundcube	Webmail	Affected: 1.6.0 , < 1.6.20 (semver) Affected: 1.7.0 , < 1.7.5 (semver) cpe:2.3:a:roundcube:webmail:::::::: cpe:2.3:a:roundcube:webmail::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114732",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T10:53:54.135527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T10:57:39.353Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Webmail",
          "repo": "https://github.com/roundcube/roundcubemail/",
          "vendor": "Roundcube",
          "versions": [
            {
              "lessThan": "1.6.20",
              "status": "affected",
              "version": "1.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.7.5",
              "status": "affected",
              "version": "1.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.6.20",
                  "versionStartIncluding": "1.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.5",
                  "versionStartIncluding": "1.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit \u201cFix bug where an alias login wasn\u2019t qualified by IMAP host\u201d."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T02:16:51.833Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "issue-tracking",
            "third-party-advisory"
          ],
          "url": "https://bugs.debian.org/1151279"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/commit/453c413d6851cf603bebdb15e58381f5ef9b8094"
        },
        {
          "tags": [
            "vendor-advisory",
            "release-notes"
          ],
          "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"
        },
        {
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"
        },
        {
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-114732",
    "datePublished": "2026-10-22T02:16:51.833Z",
    "dateReserved": "2026-10-22T02:16:51.473Z",
    "dateUpdated": "2026-10-29T10:57:39.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Mitigation

Architecture and Design

Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

CAPEC-127: Directory Indexing

An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list