Every story tagged Authentication Bypass, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
14 stories · open in the command center
CVE-2026-61514 is a critical authentication bypass vulnerability (CVSS 9.8) affecting Puwell IP Camera firmware versions 2.x through 4.x, allowing unauthenticated remote attackers to gain full control of camera functions including video access, motor control, and device restart via an unvalidated protocol field. This represents a severe supply chain and physical security risk for organizations deploying these cameras in surveillance, access control, or monitoring infrastructure. IT leaders must immediately inventory affected devices, implement network segmentation to isolate camera traffic, and coordinate urgent firmware patching with Puwell to prevent unauthorized surveillance and potential lateral network attacks.
A critical vulnerability (CVSS 9.8) in HPE Networking SD-WAN Orchestrator allows unauthenticated remote attackers to bypass authentication and access or modify sensitive system data, posing an immediate risk to organizations relying on this orchestration platform for network management. This represents a significant business impact as SD-WAN infrastructure is often central to enterprise connectivity, with potential exposure of confidential data and unauthorized system modifications. IT organizations must prioritize patching affected versions (9.6.2 and 9.6.3 series) and review network access controls to this critical infrastructure component.
CVE-2026-69703 is a critical vulnerability (CVSS 9.8) in Atlas-Livre that allows unauthenticated attackers to bypass authentication controls and execute destructive administrative actions such as record deletion through improperly implemented session checks. This represents a severe data integrity and confidentiality risk for any organization using this application, requiring immediate assessment and remediation to prevent unauthorized data manipulation and potential system compromise. IT organizations must urgently identify affected instances, implement compensating controls, and coordinate with development teams on patching this authentication bypass flaw.
CVE-2026-70552 is a critical authentication bypass vulnerability (CVSS 9.8) in MaxSite CMS 109.5 and earlier that allows unauthenticated attackers to access admin-only endpoints by exploiting a flaw in the AJAX dispatcher, potentially enabling unauthorized data manipulation and system compromise. This vulnerability poses significant business risk as it affects content management systems that may store sensitive customer data and require immediate patching to prevent unauthorized access and potential data breaches. IT organizations must prioritize inventory and remediation of affected MaxSite CMS instances to prevent exploitation, as the vulnerability is easily exploitable and automatable by threat actors.
A critical vulnerability (CVSS 8.8) in Flowise allows unauthenticated attackers to inject malicious properties into flow execution contexts through an ungated `overrideConfig` parameter in the Prediction API, potentially enabling unauthorized access, data manipulation, and system compromise. This high-severity flaw poses significant risk to organizations deploying Flowise in production environments, as it requires no authentication and could be exploited to bypass security controls or manipulate AI workflow execution. IT leaders must immediately assess their Flowise deployments and implement urgent patching and network controls to mitigate exposure to this critical vulnerability.
A critical authentication bypass vulnerability (CVSS 9.8) has been identified in Orchestrator REST API that allows attackers to spoof HTTP headers to bypass authentication controls, potentially granting unauthorized access to critical orchestration systems and sensitive operational data. This vulnerability poses a severe risk to organizations relying on orchestration platforms for critical infrastructure and business processes, requiring immediate patching and architectural review of authentication mechanisms. IT organizations must treat this as a priority security incident that could compromise system integrity, data confidentiality, and operational continuity across dependent applications and services.
CVE-2026-67337 is a critical authentication bypass vulnerability in better-auth versions below 1.4.9 that allows attackers with valid primary credentials to bypass two-factor authentication when session.cookieCache is enabled, exposing sensitive authenticated routes to unauthorized access. This CVSS 7.1 vulnerability represents a significant security risk for any organization using affected versions, particularly those relying on 2FA for compliance and data protection. IT organizations must immediately assess their dependency inventory and remediation timeline to prevent account compromise and potential data breaches.
A critical path traversal vulnerability (CVE-2026-67309, CVSS 7.8) affects Traefik versions 3.7.0-3.7.7, allowing attackers to bypass route-level authentication (BasicAuth, DigestAuth, ForwardAuth) in Kubernetes environments by exploiting regex-based path rewrites. Organizations running affected Traefik versions in production face immediate risk of unauthorized access to protected endpoints without requiring credentials. IT teams must urgently inventory Traefik deployments, prioritize upgrades to v3.7.8 or later, and audit ingress configurations using regex capture groups with rewrite targets.
ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL operations, which map to setCustomValue and setBucketSelectionStrategy in LocalDocumentType. An authenticated user with only read access (e.g., a read-only API token) can submit these ALTER TYPE statements via the HTTP command endpoint to mutate a type's custom schema metadata and bucket-selection strategy, bypassing the documented updateSchema permission boundary and potentially corrupting schema metadata and record routing.
A critical path traversal vulnerability (CVE-2026-67309) in Traefik v3.7.0 with a CVSS score of 7.8 allows attackers to bypass authentication mechanisms through the RewriteTarget feature, potentially exposing sensitive APIs and services to unauthorized access. This vulnerability poses significant risk to organizations using this popular ingress controller and reverse proxy, requiring immediate patching to prevent security breaches and compliance violations. IT leaders must assess their infrastructure for affected Traefik deployments and prioritize remediation to maintain zero-trust security posture and protect critical application endpoints.
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication (client_secret_jwt and private_key_jwt token endpoint authentication methods) but never enforces that the assertion's exp claim is in the future. The pre-check helper Boruta.Oauth.Request.Base.check_expiration/1 in lib/boruta/oauth/request/base.ex only verifies that an exp claim is present (it pattern-matches on the existence of the key and returns success), and the Joken token configuration used for signature verification, Boruta.Oauth.Authorization.Client.Token.token_config/0 in lib/boruta/oauth/authorization/client.ex, returns an empty map, so Joken's default exp claim validator is not engaged either. Any attacker who obtains a validly-signed client assertion (for example through logs, reverse proxies, browser...
A critical authentication bypass vulnerability in AWS API Gateway was discovered through a simple trailing slash manipulation, demonstrating that fundamental API security controls remain vulnerable to trivial evasion techniques. This $12K bounty finding highlights a systemic risk for IT organizations relying on API Gateway for access control, where configuration oversights can completely bypass authentication mechanisms. CIOs should immediately audit API Gateway deployments for similar misconfigurations and implement stricter validation rules, as this vulnerability type suggests widespread exposure across cloud-dependent enterprises.
A critical authentication bypass vulnerability (CVE-2026-41940) affects all supported versions of cPanel & WHM—software managing over 70 million domains—and has been actively exploited in the wild as a zero-day against hosting infrastructure globally. This vulnerability in session management could allow attackers to gain root-level administrative access to hosting servers and individual customer accounts, potentially compromising a massive portion of the internet's hosting infrastructure. IT leaders managing hosting environments or dependent on cPanel/WHM must treat this as a critical infrastructure threat requiring immediate patching and threat hunting for signs of compromise.
Microsoft released an emergency patch for a critical ASP.NET Core vulnerability (CVE-2026-40372) affecting macOS and Linux deployments that allows unauthenticated attackers to gain SYSTEM-level privileges through cryptographic signature bypass, with a severity rating of 9.1/10. Beyond immediate patching to version 10.0.7, organizations must rotate DataProtection key rings and audit long-lived authentication artifacts, as forged credentials created during the vulnerable window remain valid post-patch and could allow persistent unauthorized access. This vulnerability particularly impacts organizations running .NET 10 applications on non-Windows platforms and requires urgent remediation across both application and infrastructure layers.