CWE-289 Authentication Bypass by Alternate Name

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths

Apache Shiro has an Authentication Bypass

Soft Serve Affected by an Authentication Bypass

authentik allows a deactivated Service account to authenticate to OAuth

Spring Security annotation detection mechanism has authorization bypass

Hail relies on OIDC email claims to verify the validity of a user's domain.

Moodle Lesson activity password bypass through PHP loose comparison

Symfony has an Authentication Bypass via RememberMe

Missing key verification in gost

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

Authentication Bypass by Alternate Name in Apache Tomcat