Vulnerabilities
OpenBMB StaffDeck 0.5.6 Critical Auth Bypass Exposes Admin Tokens
Unauthenticated attackers can forge admin session tokens in OpenBMB StaffDeck versions up to 0.5.6, granting full tenant administration access via a hard-coded secret.
authentication bypass
Everything Patch Observer has reported about authentication bypass: 7 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
ZKEACMS Users Risk Admin Takeover via Hard-Coded JWT Key in CVE-2026-111633
Unauthenticated users can create forged JWT tokens to access admin functions in ZKEACMS versions up to 4.4. No fix status is provided in the source material.
Vulnerabilities
Organisations at Risk: bbs-go Flaw Enables Account Takeover via Google Token Replay Through 4.4.6
A high-severity flaw in bbs-go allows remote attackers to impersonate users by replaying Google tokens, affecting all versions through 4.4.6.
Vulnerabilities
Critical Flaw in Misaka Danmu Server Exposes Admin Access to Attackers Without Authentication
An unauthenticated flaw in Misaka Danmu Server through version 2.8.9 allows attackers to rewrite configuration keys and seize full administrative access to the platform.
Vulnerabilities
Detecting SAML Authentication Bypass in Enterprise Logs
SAML bypass attacks often leave no failed login attempts, creating silent gaps in access records that standard monitoring misses entirely.
Vulnerabilities
Orgs at risk: Eclipse EthereumAuthenticator critical flaw enables unauthenticated access via path matching errors
A critical vulnerability in Eclipse EthereumAuthenticator allows attackers to bypass authentication checks if request paths match specific patterns.
Vulnerabilities
MSPs Urged to Patch Esri Portal for ArcGIS as Critical CVE-2026-69227 Exposes Admin APIs
A critical flaw allows unauthenticated access to admin APIs in Esri Portal for ArcGIS, requiring immediate attention from managed service providers.