Topic

Authentication Bypass: news, advisories and analysis

56 articlesUpdated 28 Oct 2026

CyberSecureToday covers Authentication Bypass across 56 articles published between 8 Sep 2026 and 28 Oct 2026. The coverage includes 52 vulnerability advisories, 3 incident or breach reports and 1 analysis or guidance piece. 50 advisories are rated critical or high severity, and 16 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on Authentication Bypass most often intersect with Active Exploitation, Security Advisory and CVSS 9.8, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Dell PowerProtect Data Domain, Feature Release ver Authentication Bypass Flaw Disclosed”, was published 28 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Dell PowerProtect Data Domain, Feature Release ver Authentication Bypass Flaw Disclosed
CVE-2026-86400 in Dell PowerProtect Data Domain, Feature Release ver (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. P
Aisha Noor28 Oct 202610 min read
ThreatsCloud & SaaSCritical
The Qode Membership plugin for WordPress is vulner Authentication Bypass Flaw Disclosed
CVE-2026-92885 in The Qode Membership plugin for WordPress is vulner (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. P
Aisha Noor27 Oct 202610 min read
ThreatsCloud & SaaSHigh
Parse Server Authentication Bypass Flaw Disclosed
CVE-2026-116163 in Parse Server (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. Patch: Version 8.6.102 and later.
Aisha Noor26 Oct 202610 min read
ThreatsCloud & SaaSCritical
AAD Improper authentication in AAD App Proxy Authentication Bypass Flaw Disclosed
CVE-2026-97785 in AAD Improper authentication in AAD App Proxy (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. Patch:
Aisha Noor23 Oct 202610 min read
ThreatsCloud & SaaSCritical
Azure Enterprise Services Authentication Bypass Flaw Disclosed
CVE-2026-69854 in Azure Enterprise Services (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. Patch: Vendor security pat
Aisha Noor18 Oct 202610 min read
ThreatsCloud & SaaSCritical
WIMOOR Authentication Bypass Flaw Disclosed
CVE-2026-111691 in WIMOOR (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. Patch: Vendor security patch release.
Aisha Noor18 Oct 202610 min read
ThreatsCloud & SaaSCritical
DataBuff ai-apm-web Authentication Bypass Flaw Disclosed
CVE-2026-111692 in DataBuff ai-apm-web (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. Patch: Version 0.1.10 and later
Aisha Noor18 Oct 202610 min read
Cyber AttackBanking & Fintech
R3 Artifactory Takeover Exposes Corda Enterprise and Central Bank Digital Currency Supply Chain
A critical default join key flaw in R3's JFrog Artifactory granted full administrative control over 269 repositories, including Corda Enterprise and CBDC builds.
Daniel Okafor18 Oct 202616 min read
ThreatsCloud & SaaSCritical
PhpMyFAQ Authentication Bypass Flaw Disclosed
CVE-2026-111911 in PhpMyFAQ (Authentication Bypass) allows remote attackers to trigger arbitrary code execution. Patch: Version 4.1.9 and later.
Aisha Noor18 Oct 202610 min read
ThreatsCloud & SaaSCritical
Microsoft SharePoint Cryptographic Signature Verification Flaw CVE-2026-102866 Enables Token Forgery and Account Takeover
Microsoft patches a critical cryptographic signature verification flaw in SharePoint Server (CVE-2026-102866) that permits token tampering and full administrative impersonation.
CST Editorial Desk17 Oct 20269 min read
ThreatsIndustrial & OTCritical
Thermo Fisher Torrent Suite Flaws Expose Genomic Sequencing Labs to Authentication Bypass
CISA Advisory ICSMA-26-288-01 warns of critical authentication bypass and execution vulnerabilities in Thermo Fisher Torrent Suite software used in clinical genomic sequencing.
CST Editorial Desk17 Oct 20269 min read
ThreatsCloud & SaaS
AhsayCBS Authentication Bypass Exploited Against Backup Servers
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.
CST Editorial Desk16 Oct 20267 min read
ThreatsCloud & SaaSHigh
SimpleForm WordPress Plugin Flaw Lets Visitors Register as Admin
WordPress security advisory resolves a high-severity privilege escalation flaw in SimpleForm (CVE-2026-104748) allowing unauthenticated users to register as admin.
Priya Raman14 Oct 20268 min read
ThreatsCloud & SaaSHigh
Apache Airflow FAB Provider Flaw Lets OAuth Users Escalate to Admin
Apache Airflow releases security fix for CVE-2026-75156 in the Flask-AppBuilder provider, patching an OAuth2 role-mapping flaw leading to admin privilege escalation.
CST Editorial Desk14 Oct 20268 min read
ThreatsCloud & SaaSHigh
Google Cloud Workload Identity Federation OIDC Token Bypass Flaw CVE-2026-19410 Remediated
Google Cloud updates authentication libraries for CVE-2026-19410 where improper audience validation allowed external OIDC tokens to impersonate IAM service accounts.
Aisha Noor14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Ivanti Connect Secure SAML Bypass Opens Gateways to Pre-Auth Code Execution
Ivanti discloses critical vulnerability CVE-2026-104935 in Connect Secure and Policy Secure gateways allowing pre-auth SAML remote code execution.
Mei-Lin Chen14 Oct 20269 min read
ThreatsIndustrial & OTCritical
Rockwell FactoryTalk View SE Flaw Allows Remote Authentication Bypass and Console Takeover
Rockwell Automation and CISA disclose a critical vulnerability in FactoryTalk View SE human-machine interface software allowing unauthenticated operators to bypass security.
CST Editorial Desk9 Oct 20268 min read
ThreatsCloud & SaaSCritical
LiteLLM AI Model Gateway Vulnerability Allows Unauthenticated JWT Signature Bypass and Private LLM Hijacking (CVE-2026-55102)
A critical vulnerability in LiteLLM AI Proxy allows unauthenticated actors to forge JWT tokens and hijack enterprise foundational model pipelines.
Aisha Noor9 Oct 20268 min read
ThreatsIndustrial & OTCritical
Siemens SIMATIC WinCC OA SCADA Authentication Bypass Enables Unauthenticated Industrial Telemetry Tampering (CVE-2026-51982)
Siemens ProductCERT discloses a critical authentication bypass vulnerability in SIMATIC WinCC Open Architecture SCADA web interfaces affecting critical infrastructure.
CST Editorial Desk8 Oct 20268 min read
ThreatsCloud & SaaSCritical
AWS Loom AI Agent Platform Flaw Gave Unauthenticated Attackers Super-Admin Control
CVE-2026-103956 in AWS Labs Loom (CVSS 10.0) let any network client act as super-admin on IdP-less deployments. Two SSRF flaws leaked tokens. Upgrade to 1.7.0+.
Aisha Noor4 Oct 20267 min read
ThreatsCloud & SaaSHigh
ProcessOne ejabberd SASL-PLAIN Flaw Allows Arbitrary User Impersonation Across XMPP Networks (CVE-2026-104733)
A high-severity identity validation flaw in ProcessOne ejabberd allows authenticated users to impersonate any target user via unvalidated authzid tokens.
Mei-Lin Chen2 Oct 20268 min read
ThreatsCloud & SaaSHigh
389 Directory Server STARTTLS Buffer Injection Flaw Enables On-Path Authentication Bypass (CVE-2026-86345)
A flaw in 389 Directory Server fails to discard buffered plaintext bytes during StartTLS negotiation, enabling on-path attackers to forge successful LDAP authentications.
Aisha Noor2 Oct 20268 min read
ThreatsCloud & SaaSCritical
Fleet Device Management API Flaw Allows Host Impersonation and MDM Hijacking
An authentication bypass in Fleet device APIs allows unauthenticated remote attackers to impersonate enrolled Apple devices and trigger MDM actions.
CST Editorial Desk1 Oct 202612 min read
Cyber AttackCloud & SaaS
SOGo Groupware Proxy Authentication Flaw Allows Unauthenticated Account Impersonation via WebObjects Header (CVE-2026-74864)
An authentication bypass in SOGo groupware allows remote attackers to impersonate any user without credentials by supplying an unsanitized x-webobjects-remote-user header.
CST Editorial Desk1 Oct 202611 min read