CWE-305 Authentication Bypass by Primary Weakness

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

Keycloak has an Authentication Bypass by Primary Weakness

Rancher has Privilege Escalation from Project Owner to Host

Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

MLflow: unauthenticated access to certain FastAPI routes

Ory Oathkeeper has an authentication bypass by cache key confusion

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

Keycloak SAML Broken has Authentication Bypass by Primary Weakness

MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service

go-f3 Vulnerable to Cached Justification Verification Bypass

RatPanel can perform remote command execution without authorization

File Browser's password protection of links is bypassable

File Browser’s insecure JWT handling can lead to session replay attacks after logout

OPKSSH Vulnerable to Authentication Bypass

OpenPubkey Vulnerable to Authentication Bypass

Security Update for the OPC UA .NET Standard Stack

Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack

TShock Security Escalation Exploit

rdiffweb vulnerable to Authentication Bypass by Primary Weakness

Authentication Bypass in modoboa

Navidrome uses MD5 hashing algorithm

PrivateBin allows shortening of URLs for other domains

Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process