Common Weakness Enumeration

CWE-289

Allowed

Authentication Bypass by Alternate Name

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

81 vulnerabilities reference this CWE, most recent first.

GHSA-CV5F-6R7G-8Q4W

Vulnerability from github – Published: 2025-03-31 15:30 – Updated: 2025-03-31 15:30
VLAI
Details

Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.

Severity
9.6 (Critical)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-29266"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-31T13:15:43Z",
    "severity": "CRITICAL"
  },
  "details": "Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.",
  "id": "GHSA-cv5f-6r7g-8q4w",
  "modified": "2025-03-31T15:30:44Z",
  "published": "2025-03-31T15:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29266"
    },
    {
      "type": "WEB",
      "url": "https://docs.unraid.net/unraid-os/release-notes/7.0.1"
    },
    {
      "type": "WEB",
      "url": "https://edac.dev/security/CVE-2025-29266"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unraid/webgui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FP7W-M676-W7GC

Vulnerability from github – Published: 2026-09-24 19:55 – Updated: 2026-09-24 19:55
VLAI
Summary
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
Details

Impact

The Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID.

When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop.

The issue affects applications using the Vend OAuth2 backend with more than one Vend shop.

Patches

The issue has been fixed by scoping Vend social-auth UIDs by shop.

Users should upgrade to a patched version.

Fix:

  • https://github.com/python-social-auth/social-core/pull/1795

Workarounds

Applications that cannot upgrade immediately should restrict the Vend OAuth2 backend to a single trusted Vend shop.

If Vend authentication is not required, the Vend backend can also be disabled by removing it from SOCIAL_AUTH_AUTHENTICATION_BACKENDS.

There is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend.

Credits

Reported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.

Reporter references:

  • https://lzhou1110.github.io/
  • https://zyy0530.github.io/
  • https://str1ckl4nd.github.io/
  • https://maurice.busystar.org/
  • https://7thparkk.github.io/
Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "social-auth-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T19:55:57Z",
    "nvd_published_at": "2026-09-24T18:17:14Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThe Vend OAuth2 backend used only the numeric Vend `user_id` as the social-auth UID.\n\nWhen multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop.\n\nThe issue affects applications using the Vend OAuth2 backend with more than one Vend shop.\n\n### Patches\n\nThe issue has been fixed by scoping Vend social-auth UIDs by shop.\n\nUsers should upgrade to a patched version.\n\nFix:\n\n* https://github.com/python-social-auth/social-core/pull/1795\n\n### Workarounds\n\nApplications that cannot upgrade immediately should restrict the Vend OAuth2 backend to a single trusted Vend shop.\n\nIf Vend authentication is not required, the Vend backend can also be disabled by removing it from `SOCIAL_AUTH_AUTHENTICATION_BACKENDS`.\n\nThere is no complete workaround while continuing to allow authentication from multiple Vend shops with the vulnerable backend.\n\n### Credits\n\nReported through GitHub private vulnerability reporting by Liyi Zhou, Ziyue Wang, Strick, Maurice, and Chenchen Yu from the University of Sydney security research team.\n\nReporter references:\n\n* https://lzhou1110.github.io/\n* https://zyy0530.github.io/\n* https://str1ckl4nd.github.io/\n* https://maurice.busystar.org/\n* https://7thparkk.github.io/",
  "id": "GHSA-fp7w-m676-w7gc",
  "modified": "2026-09-24T19:55:58Z",
  "published": "2026-09-24T19:55:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-social-auth/social-core/security/advisories/GHSA-fp7w-m676-w7gc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57176"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-social-auth/social-core/pull/1795"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-social-auth/social-core/commit/dee7ad1785877afd355dd6860598823d2631b76e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-social-auth/social-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-social-auth/social-core/releases/tag/5.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend"
}

GHSA-FV2H-753J-9G39

Vulnerability from github – Published: 2023-09-20 23:01 – Updated: 2024-10-11 15:37
VLAI
Summary
Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation
Details

Impact

When a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider.

An application is impacted if they rely on any of these features in their authentication/authorization logic: * the issuer of the generated identity and claims * items in the stored request state (AuthenticationProperties)

Patches

Patched in version 2.9.2 and 1.0.3. All previous versions are vulnerable.

Workarounds

The AcsCommandResultCreated notification can be used to add the validation required if an upgrade to patched packages is not possible.

References

The patch is linked to https://github.com/Sustainsys/Saml2/issues/712 and https://github.com/Sustainsys/Saml2/issues/713

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Sustainsys.Saml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Sustainsys.Saml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Kentor.AuthServices"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-41890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289",
      "CWE-294"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-20T23:01:52Z",
    "nvd_published_at": "2023-09-19T15:15:52Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nWhen a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider.\n\nAn application is impacted if they rely on any of these features in their authentication/authorization logic:\n* the issuer of the generated identity and claims\n* items in the stored request state (AuthenticationProperties)\n\n### Patches\nPatched in version 2.9.2 and 1.0.3. All previous versions are vulnerable.\n\n### Workarounds\nThe `AcsCommandResultCreated` notification can be used to add the validation required if an upgrade to patched packages is not possible.\n\n### References\nThe patch is linked to https://github.com/Sustainsys/Saml2/issues/712 and https://github.com/Sustainsys/Saml2/issues/713\n",
  "id": "GHSA-fv2h-753j-9g39",
  "modified": "2024-10-11T15:37:58Z",
  "published": "2023-09-20T23:01:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41890"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sustainsys/Saml2/issues/712"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sustainsys/Saml2/issues/713"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sustainsys/Saml2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation"
}

GHSA-G57M-HR98-5M89

Vulnerability from github – Published: 2026-06-26 03:31 – Updated: 2026-08-10 15:33
VLAI
Details

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Severity
7.7 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-48618"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-176",
      "CWE-289"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-26T02:16:52Z",
    "severity": "HIGH"
  },
  "details": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
  "id": "GHSA-g57m-hr98-5m89",
  "modified": "2026-08-10T15:33:29Z",
  "published": "2026-06-26T03:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48618"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48618.json"
    },
    {
      "type": "WEB",
      "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-48618"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:9455"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:7378"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:52399"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:41947"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:39868"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:39246"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35892"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35891"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35842"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35841"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:30172"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:29012"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:28727"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-G7CR-9H7Q-4QXQ

Vulnerability from github – Published: 2026-03-12 14:21 – Updated: 2026-04-06 22:45
VLAI
Summary
OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty
Details

OpenClaw's Microsoft Teams plugin widened group sender authorization when a team/channel route allowlist was configured but groupAllowFrom was empty. Before the fix, a matching route allowlist entry could cause the message handler to synthesize wildcard sender authorization for that route, allowing any sender in the matched team/channel to bypass the intended groupPolicy: "allowlist" sender check.

This does not affect default unauthenticated access, but it does weaken a documented Teams group authorization boundary and can allow unauthorized group senders to trigger replies in allowlisted Teams routes.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published vulnerable version: 2026.3.7
  • Affected range: <= 2026.3.7
  • Fixed in released version: 2026.3.8

Fix Commit(s)

  • 88aee9161e0e6d32e810a25711e32a808a1777b2

Release Verification

  • Verified fixed in GitHub release v2026.3.8 published on March 9, 2026.
  • Verified npm view openclaw version resolves to 2026.3.8.
  • Verified the release contains the regression test covering the Teams route-allowlist sender-bypass case and that the test passes against the v2026.3.8 tree.

Thanks @zpbrent for reporting.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.7"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34506"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T14:21:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "OpenClaw\u0027s Microsoft Teams plugin widened group sender authorization when a team/channel route allowlist was configured but `groupAllowFrom` was empty. Before the fix, a matching route allowlist entry could cause the message handler to synthesize wildcard sender authorization for that route, allowing any sender in the matched team/channel to bypass the intended `groupPolicy: \"allowlist\"` sender check.\n\nThis does not affect default unauthenticated access, but it does weaken a documented Teams group authorization boundary and can allow unauthorized group senders to trigger replies in allowlisted Teams routes.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Latest published vulnerable version: `2026.3.7`\n- Affected range: `\u003c= 2026.3.7`\n- Fixed in released version: `2026.3.8`\n\n## Fix Commit(s)\n\n- `88aee9161e0e6d32e810a25711e32a808a1777b2`\n\n## Release Verification\n\n- Verified fixed in GitHub release `v2026.3.8` published on March 9, 2026.\n- Verified `npm view openclaw version` resolves to `2026.3.8`.\n- Verified the release contains the regression test covering the Teams route-allowlist sender-bypass case and that the test passes against the `v2026.3.8` tree.\n\nThanks @zpbrent for reporting.",
  "id": "GHSA-g7cr-9h7q-4qxq",
  "modified": "2026-04-06T22:45:49Z",
  "published": "2026-03-12T14:21:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g7cr-9h7q-4qxq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34506"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/88aee9161e0e6d32e810a25711e32a808a1777b2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-in-microsoft-teams-plugin-via-route-allowlist-configuration"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw\u0027s MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty"
}

GHSA-H2P8-37QR-QFR9

Vulnerability from github – Published: 2025-08-20 18:30 – Updated: 2025-12-24 00:30
VLAI
Details

A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-8415"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-20T17:15:37Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in the Cryostat HTTP API. Cryostat\u0027s HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.",
  "id": "GHSA-h2p8-37qr-qfr9",
  "modified": "2025-12-24T00:30:12Z",
  "published": "2025-08-20T18:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8415"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryostatio/cryostat/pull/1001"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:14919"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-8415"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2385773"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cryostatio/cryostat/releases/tag/v4.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H7MP-657P-HG4H

Vulnerability from github – Published: 2026-09-23 21:30 – Updated: 2026-09-23 21:30
VLAI
Details

Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-95514"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-23T19:19:51Z",
    "severity": "MODERATE"
  },
  "details": "Unauthenticated Bypass Vulnerability in Netgsm \u003c= 2.10.0 versions.",
  "id": "GHSA-h7mp-657p-hg4h",
  "modified": "2026-09-23T21:30:50Z",
  "published": "2026-09-23T21:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95514"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/netgsm/vulnerability/wordpress-netgsm-plugin-2-10-0-bypass-vulnerability-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HHW8-PPCX-3FJJ

Vulnerability from github – Published: 2023-08-14 06:30 – Updated: 2024-04-04 06:54
VLAI
Details

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-3263"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-289"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-14T05:15:09Z",
    "severity": "HIGH"
  },
  "details": "The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.",
  "id": "GHSA-hhw8-ppcx-3fjj",
  "modified": "2024-04-04T06:54:35Z",
  "published": "2023-08-14T06:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3263"
    },
    {
      "type": "WEB",
      "url": "https://www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MWXV-35WR-4VVJ

Vulnerability from github – Published: 2026-03-03 18:54 – Updated: 2026-03-20 21:12
VLAI
Summary
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
Details

Summary

Gateway plugin route auth protection for /api/channels could be bypassed using encoded dot-segment traversal (for example ..%2f) in path variants that plugin handlers normalize.

Affected Packages / Versions

  • Package: npm openclaw
  • Latest published vulnerable version: 2026.2.25
  • Vulnerable version range: <= 2026.2.25
  • Patched version: 2026.2.26 (planned next release)

Impact

Under affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to /api/channels/... handlers.

Fix Commit(s)

  • 258d615c45527ffda37cecd08cd268f97461bde0

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.26). After npm publish, maintainers only need to publish the advisory.

OpenClaw thanks @zpbrent for reporting.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
8.3 (High)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.2.25"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-289"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T18:54:35Z",
    "nvd_published_at": "2026-03-19T22:16:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nGateway plugin route auth protection for `/api/channels` could be bypassed using encoded dot-segment traversal (for example `..%2f`) in path variants that plugin handlers normalize.\n\n### Affected Packages / Versions\n- Package: npm `openclaw`\n- Latest published vulnerable version: `2026.2.25`\n- Vulnerable version range: `\u003c= 2026.2.25`\n- Patched version: `2026.2.26` (planned next release)\n\n### Impact\nUnder affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to `/api/channels/...` handlers.\n\n### Fix Commit(s)\n- `258d615c45527ffda37cecd08cd268f97461bde0`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish, maintainers only need to publish the advisory.\n\nOpenClaw thanks @zpbrent for reporting.",
  "id": "GHSA-mwxv-35wr-4vvj",
  "modified": "2026-03-20T21:12:44Z",
  "published": "2026-03-03T18:54:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-mwxv-35wr-4vvj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32036"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/258d615c45527ffda37cecd08cd268f97461bde0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-authentication-bypass-via-encoded-dot-segment-traversal-in-api-channels"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths"
}

GHSA-PCHF-49FH-W34R

Vulnerability from github – Published: 2026-01-21 23:02 – Updated: 2026-01-23 15:46
VLAI
Summary
Soft Serve Affected by an Authentication Bypass
Details

Impact

What kind of vulnerability is it? Who is impacted?

This issue impacts every Soft Serve instance.

A critical authentication bypass allows an attacker to impersonate any user (including Admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails.

Patches

Has the problem been patched? What versions should users upgrade to?

Yes, please upgrade to version 0.11.3 as soon as possible.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

You need to upgrade

Severity
8.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.11.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/charmbracelet/soft-serve"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24058"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T23:02:07Z",
    "nvd_published_at": "2026-01-22T22:16:21Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis issue impacts every Soft Serve instance.\n\nA critical authentication bypass allows an attacker to impersonate any user (including Admin) by \"offering\" the victim\u0027s public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the \"offer\" phase and is not cleared if that specific authentication attempt fails.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nYes, please upgrade to version 0.11.3 as soon as possible.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nYou need to upgrade",
  "id": "GHSA-pchf-49fh-w34r",
  "modified": "2026-01-23T15:46:52Z",
  "published": "2026-01-21T23:02:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24058"
    },
    {
      "type": "WEB",
      "url": "https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/charmbracelet/soft-serve"
    },
    {
      "type": "WEB",
      "url": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Soft Serve Affected by an Authentication Bypass"
}
Mitigation MIT-44
Architecture and Design

Strategy: Input Validation

Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.

Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-20
Implementation

Strategy: Input Validation

Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list