Vulnerabilities
LatePoint WordPress Plugin Race Condition Bypasses OTP Authentication Lockout
Unauthenticated attackers can bypass account lockouts on LatePoint versions through 5.7.4 by exploiting a race condition in the verification process.
Authentication Bypass
Everything Vuln Post has reported about Authentication Bypass: 9 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Vulnerabilities
OpenAEV Patch Fixes Unauthenticated Access to Adversary Simulation Data
A high-severity flaw in OpenAEV allows unauthenticated users to read and modify exercise data. Version 2.260622.0 provides a fix for the authentication bypass.
Vulnerabilities
FileRise WebDAV Bypass Allows Login Without TOTP in Versions Before 3.16.0
A high-severity flaw in FileRise lets attackers bypass two-factor authentication on the WebDAV service using only primary credentials.
Vulnerabilities
Diaple Stela Cookie Manipulation Grants Unauthenticated Super Admin Access in Pre-1.60.1 Versions
Diaple Stela versions prior to 1.60.1 contain a critical flaw allowing remote attackers to bypass login checks and gain full administrative access without credentials.
Vulnerabilities
IBM MCP Context Forge: CVE-2026-53709 Critical Vuln Enables Unauth Admin Token Forge in Pre-1.0.2 Versions
A critical flaw in IBM MCP Context Forge allows attackers to forge admin tokens. Version 1.0.2 fixes the issue by removing the default signing key and tightening access controls.
Vulnerabilities
Wukong_HRM Critical Auth Bypass CVE-2026-108707 Exposes Employee Data and Admin Controls Without Credentials
A critical flaw in Wukong_HRM lets attackers bypass login checks to access sensitive employee data and administrative controls without valid credentials.
Vulnerabilities
Advanced IP Blocker CVE-2026-104732: Unauthenticated TOTP Brute-Force Grants Full WordPress Control
A critical flaw in the Advanced IP Blocker plugin allows unauthenticated attackers to bypass two-factor authentication and seize full control of WordPress sites.
Vulnerabilities
Nginx UI logic flaw CVE-2026-107808 bypasses WebAuthn 2FA for pre-2.5.0 users
A logic error in Nginx UI versions prior to 2.5.0 allows password-only login for accounts protected by WebAuthn passkeys, ignoring the second factor requirement.
Vulnerabilities
Stop Authentication Bypass Vulnerabilities with Priority Controls
Most authentication bypasses occur because systems trust client-side state instead of verifying every request against a secure server-side session.