Authentication bypass

6 articles

CVEBarracuda

Barracuda Email Security Gateway: two new bugs chain from no login to root through the admin page (CVE-2026-116606, CVE-2026-111560)

How to fix CVE-2026-116606: upgrade Barracuda Email Security Gateway to 9.4.0.030 or later. Paired with CVE-2026-111560 it goes from no login to root through the admin web interface. Check that port 8000 is not on the internet and that Firmware Patches is not set to Disable.

HOL Guard
BreakingCVE

Langflow CVE-2026-93680 and 32 more bugs. Strangers can get into 1.12.x servers, so upgrade to 1.13.0

How to fix CVE-2026-93680: upgrade Langflow to 1.13.0. IBM published 33 Langflow CVEs on Oct 29, 2026. Two 9.8s through 1.12.8 need no login, Metasploit already has a module for the auth bypass, and the upgrade can lock you out unless you set a superuser password first.

HOL Guard
BreakingCVE

BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, now on CISA KEV (CVE-2026-102764)

How to fix CVE-2026-102764: upgrade BeyondTrust Remote Support to 24.3.1 or later and apply the BT26-05-RS patch from /appliance. Exploited as a zero-day since August, on CISA KEV Oct 16. Patching does not evict an attacker already inside.

HOL Guard
BreakingCVE

Ivanti Connect Secure login bypass is being exploited, now on CISA KEV (CVE-2026-104935)

How to fix CVE-2026-104935: upgrade Ivanti Connect Secure to 25.1.1.2, 22.8R2.5 or 25.1.3.x. Attackers are using this login bypass to run commands on the VPN, and CISA gave agencies until Oct 16.

HOL Guard
CVEApache artemis

CVE-2026-57967: unauth Artemis CORE session steal and OpenWire queue delete

How to fix CVE-2026-57967: upgrade Apache Artemis / ActiveMQ Artemis to 2.57.0. Unauth CORE SESSION_REATTACH can steal a live session; OpenWire RemoveSubscriptionInfo can delete queues before auth.

HOL Guard
CVESecurity

CVE-2026-18108: Net::SAML2 Authentication Bypass via Unsigned Encrypted Assertions (CVSS 9.8)

Net::SAML2 before 0.86 accepts decrypted SAML assertions that carry no XML signature. Any party can encrypt an unsigned assertion to an SP's published certificate and authenticate as an arbitrary user. Affects Azure AD, Okta, Google, ADFS, and all other IdPs.

HOL Guard

Related topics

Keep exploring

The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.

Security research hubPlugin marketplace