# Auth bypass security incidents · pwn.watch

> Security incidents tagged Auth bypass (vendor, product, platform or attack type).

Page: https://pwn.watch/t/auth-bypass · generated 2026-10-22T23:39:04.690Z

## Status (as of 2026-10-22)
- Incidents: 64 (1 live, 0 live and not fully patched, 63 patched)
- Days without a Auth bypass security incident: 1
- Newest incident started: 2026-10-21

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/auth-bypass.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/auth-bypass/feed.xml
- This file: https://pwn.watch/t/auth-bypass/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Keycloak unauthenticated account takeover gets a public exploit (CVE-2026-18963)](https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover) ([json](https://pwn.watch/i/keycloak-cve-2026-18963-reset-credentials-takeover.json)): critical, live, patched, started 2026-10-21, CVE-2026-18963
- [GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability](https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706) ([json](https://pwn.watch/i/gitlab-community-edition-and-enterprise-edition-cve-2026-85706.json)): high, closed, patched, started 2026-09-11, CVE-2026-85706
- [Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management: Cisco Firewall Management Center Authentication Bypass Using](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew) ([json](https://pwn.watch/i/cisco-secure-firewall-management-center-fmc-and-security-cloud-control-scc-firew.json)): high, closed, patched, started 2026-09-09, CVE-2026-20079
- [Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability](https://pwn.watch/i/citrix-netscaler-cve-2026-19490) ([json](https://pwn.watch/i/citrix-netscaler-cve-2026-19490.json)): high, closed, patched, started 2026-09-09, CVE-2026-19490
- [BerriAI LiteLLM: BerriAI LiteLLM Improper Authentication Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-59822) ([json](https://pwn.watch/i/berriai-litellm-cve-2026-59822.json)): high, closed, patched, started 2026-09-02, CVE-2026-59822
- [JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerability](https://pwn.watch/i/jfrog-artifactory-cve-2026-82329) ([json](https://pwn.watch/i/jfrog-artifactory-cve-2026-82329.json)): high, closed, patched, started 2026-09-02, CVE-2026-82329
- [Apple macOS: Apple macOS Improper Authentication Vulnerability](https://pwn.watch/i/apple-macos-cve-2026-65400) ([json](https://pwn.watch/i/apple-macos-cve-2026-65400.json)): high, closed, patched, started 2026-08-18, CVE-2026-65400
- [N-able N-central: N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability](https://pwn.watch/i/n-able-n-central-cve-2026-18577) ([json](https://pwn.watch/i/n-able-n-central-cve-2026-18577.json)): high, closed, patched, started 2026-08-03, CVE-2026-18577, CVE-2026-18556
- [Check Point SmartConsole: Check Point SmartConsole Improper Authentication Vulnerability](https://pwn.watch/i/check-point-smartconsole-cve-2026-16232) ([json](https://pwn.watch/i/check-point-smartconsole-cve-2026-16232.json)): high, closed, patched, started 2026-07-22, CVE-2026-16232
- [Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164.json)): high, closed, patched, started 2026-07-14, CVE-2026-56164
- [Oracle PeopleSoft Enterprise PeopleTools: Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273) ([json](https://pwn.watch/i/oracle-peoplesoft-enterprise-peopletools-cve-2026-35273.json)): high, closed, patched, started 2026-06-12, CVE-2026-35273
- [Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerability](https://pwn.watch/i/check-point-security-gateway-cve-2026-50751) ([json](https://pwn.watch/i/check-point-security-gateway-cve-2026-50751.json)): high, closed, patched, started 2026-06-08, CVE-2026-50751
- [Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257) ([json](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2026-0257.json)): high, closed, patched, started 2026-05-29, CVE-2026-0257
- [Cisco Catalyst SD-WAN: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-cve-2026-20182.json)): high, closed, patched, started 2026-05-14, CVE-2026-20182
- [WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940) ([json](https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json)): high, closed, patched, started 2026-04-30, CVE-2026-41940
- [Ivanti Endpoint Manager (EPM): Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603) ([json](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2026-1603.json)): high, closed, patched, started 2026-03-09, CVE-2026-1603
- [Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability](https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127) ([json](https://pwn.watch/i/cisco-catalyst-sd-wan-controller-and-manager-cve-2026-20127.json)): high, closed, patched, started 2026-02-25, CVE-2026-20127
- [SmarterTools SmarterMail: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/smartertools-smartermail-cve-2026-24423) ([json](https://pwn.watch/i/smartertools-smartermail-cve-2026-24423.json)): high, closed, patched, started 2026-02-05, CVE-2026-24423
- [Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability](https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858) ([json](https://pwn.watch/i/fortinet-multiple-products-cve-2026-24858.json)): high, closed, patched, started 2026-01-27, CVE-2026-24858
- [Oracle Fusion Middleware: Fusion Middleware Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757) ([json](https://pwn.watch/i/oracle-fusion-middleware-cve-2025-61757.json)): critical, closed, patched, started 2025-11-21, CVE-2025-61757
- [Kentico Xperience CMS: 2 exploited vulnerabilities (CVE-2025-2746, CVE-2025-2747)](https://pwn.watch/i/kentico-xperience-cms-cve-2025-2746) ([json](https://pwn.watch/i/kentico-xperience-cms-cve-2025-2746.json)): critical, closed, patched, started 2025-10-20, CVE-2025-2746, CVE-2025-2747
- [SKYSEA Client View: Client View Improper Authentication Vulnerability](https://pwn.watch/i/skysea-client-view-cve-2016-7836) ([json](https://pwn.watch/i/skysea-client-view-cve-2016-7836.json)): critical, closed, patched, started 2025-10-14, CVE-2016-7836
- [Juniper ScreenOS: ScreenOS Improper Authentication Vulnerability](https://pwn.watch/i/juniper-screenos-cve-2015-7755) ([json](https://pwn.watch/i/juniper-screenos-cve-2015-7755.json)): critical, closed, patched, started 2025-10-02, CVE-2015-7755
- [TP-Link TL-WR841N: TL-WR841N Authentication Bypass by Spoofing Vulnerability](https://pwn.watch/i/tp-link-tl-wr841n-cve-2023-50224) ([json](https://pwn.watch/i/tp-link-tl-wr841n-cve-2023-50224.json)): medium, closed, patched, started 2025-09-03, CVE-2023-50224
- [TP-Link TL-WA855RE: TL-WA855RE Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/tp-link-tl-wa855re-cve-2020-24363) ([json](https://pwn.watch/i/tp-link-tl-wa855re-cve-2020-24363.json)): high, closed, patched, started 2025-09-02, CVE-2020-24363
- [Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability](https://pwn.watch/i/sangoma-freepbx-cve-2025-57819) ([json](https://pwn.watch/i/sangoma-freepbx-cve-2025-57819.json)): critical, closed, patched, started 2025-08-29, CVE-2025-57819
- [AMI MegaRAC SPx: MegaRAC SPx Authentication Bypass by Spoofing Vulnerability](https://pwn.watch/i/ami-megarac-spx-cve-2024-54085) ([json](https://pwn.watch/i/ami-megarac-spx-cve-2024-54085.json)): critical, closed, patched, started 2025-06-25, CVE-2024-54085
- [ASUS Routers: Routers Improper Authentication Vulnerability](https://pwn.watch/i/asus-routers-cve-2021-32030) ([json](https://pwn.watch/i/asus-routers-cve-2021-32030.json)): critical, closed, patched, started 2025-06-02, CVE-2021-32030
- [ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability](https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935) ([json](https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935.json)): high, closed, patched, started 2025-06-02, CVE-2025-3935
- [Ivanti Endpoint Manager Mobile (EPMM): 2 exploited vulnerabilities (CVE-2025-4427, CVE-2025-4428)](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-cve-2025-4427.json)): high, closed, patched, started 2025-05-19, CVE-2025-4427, CVE-2025-4428
- [Langflow: Missing Authentication Vulnerability](https://pwn.watch/i/langflow-cve-2025-3248) ([json](https://pwn.watch/i/langflow-cve-2025-3248.json)): critical, closed, patched, started 2025-05-05, CVE-2025-3248
- [Erlang/OTP SSH: CVSS 10 unauthenticated RCE (CVE-2025-32433)](https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433) ([json](https://pwn.watch/i/erlang-otp-ssh-unauthenticated-rce-cve-2025-32433.json)): critical, closed, patched, started 2025-04-16, CVE-2025-32433
- [CrushFTP: Authentication Bypass Vulnerability](https://pwn.watch/i/crushftp-cve-2025-31161) ([json](https://pwn.watch/i/crushftp-cve-2025-31161.json)): critical, closed, patched, started 2025-04-07, CVE-2025-31161
- [Next.js middleware authorization bypass via x-middleware-subrequest (CVE-2025-29927)](https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927) ([json](https://pwn.watch/i/nextjs-middleware-auth-bypass-cve-2025-29927.json)): critical, closed, patched, started 2025-03-21, CVE-2025-29927
- [Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472) ([json](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2025-24472.json)): critical, closed, patched, started 2025-03-18, CVE-2025-24472
- [SonicWall SonicOS: SonicOS SSLVPN Improper Authentication Vulnerability](https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704) ([json](https://pwn.watch/i/sonicwall-sonicos-cve-2024-53704.json)): critical, closed, patched, started 2025-02-18, CVE-2024-53704
- [Palo Alto Networks PAN-OS: PAN-OS Authentication Bypass Vulnerability](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2025-0108) ([json](https://pwn.watch/i/palo-alto-networks-pan-os-cve-2025-0108.json)): high, closed, patched, started 2025-02-18, CVE-2025-0108
- [Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerability](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591) ([json](https://pwn.watch/i/fortinet-fortios-and-fortiproxy-cve-2024-55591.json)): critical, closed, patched, started 2025-01-14, CVE-2024-55591
- [NUUO NVRmini2 Devices Missing Authentication](https://pwn.watch/i/nuuo-nvrmini2-devices-cve-2022-23227) ([json](https://pwn.watch/i/nuuo-nvrmini2-devices-cve-2022-23227.json)): critical, closed, unpatched, started 2024-12-18, CVE-2022-23227
- [ProjectSend Improper Authentication](https://pwn.watch/i/projectsend-cve-2024-11680) ([json](https://pwn.watch/i/projectsend-cve-2024-11680.json)): critical, closed, patched, started 2024-11-26, CVE-2024-11680
- [Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function](https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461) ([json](https://pwn.watch/i/array-networks-ag-vxag-arrayos-cve-2023-28461.json)): critical, closed, patched, started 2024-11-25, CVE-2023-28461
- [Palo Alto PAN-OS management interface auth bypass + privilege escalation](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474) ([json](https://pwn.watch/i/palo-alto-pan-os-management-auth-bypass-cve-2024-0012-9474.json)): critical, closed, patched, started 2024-11-18, CVE-2024-0012, CVE-2024-9474
- [CyberPersons CyberPanel: 2 actively exploited vulnerabilities](https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378) ([json](https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378.json)): critical, closed, patched, started 2024-10-29, CVE-2024-51567, CVE-2024-51378
- [FortiManager 'FortiJump' missing authentication zero-day (CVE-2024-47575)](https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575) ([json](https://pwn.watch/i/fortinet-fortimanager-fortijump-cve-2024-47575.json)): critical, closed, patched, started 2024-10-23, CVE-2024-47575
- [Dahua IP Camera Firmware: 2 actively exploited vulnerabilities](https://pwn.watch/i/dahua-ip-camera-firmware-cve-2021-33044-33045) ([json](https://pwn.watch/i/dahua-ip-camera-firmware-cve-2021-33044-33045.json)): critical, closed, patched, started 2024-08-21, CVE-2021-33044, CVE-2021-33045
- [Ivanti Virtual Traffic Manager Authentication Bypass](https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593) ([json](https://pwn.watch/i/ivanti-virtual-traffic-manager-cve-2024-7593.json)): critical, closed, patched, started 2024-08-13, CVE-2024-7593
- [Palo Alto Networks Expedition: 3 actively exploited vulnerabilities](https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465) ([json](https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465.json)): critical, closed, patched, started 2024-07-10, CVE-2024-5910, CVE-2024-9463, CVE-2024-9465
- [VMware ESXi Authentication Bypass](https://pwn.watch/i/vmware-esxi-cve-2024-37085) ([json](https://pwn.watch/i/vmware-esxi-cve-2024-37085.json)): medium, closed, patched, started 2024-06-25, CVE-2024-37085
- [Progress Telerik Report Server Authentication Bypass by Spoofing](https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358) ([json](https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358.json)): critical, closed, patched, started 2024-05-29, CVE-2024-4358
- [JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199) ([json](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json)): critical, closed, patched, started 2024-03-04, CVE-2024-27198, CVE-2024-27199
- [ConnectWise ScreenConnect auth bypass mass-exploited](https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709) ([json](https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709.json)): critical, closed, patched, started 2024-02-19, CVE-2024-1709, CVE-2024-1708
- [Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082) ([json](https://pwn.watch/i/ivanti-endpoint-manager-mobile-epmm-and-mobileiron-cve-2023-35082.json)): critical, closed, patched, started 2024-01-18, CVE-2023-35082
- [Ivanti Connect Secure zero-days chained for mass VPN compromise](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893) ([json](https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893.json)): critical, closed, patched, started 2024-01-10, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893
- [Juniper Junos OS: 5 exploited vulnerabilities](https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more) ([json](https://pwn.watch/i/juniper-junos-os-cve-2023-36844-and-4-more.json)): critical, closed, patched, started 2023-11-13, CVE-2023-36844, CVE-2023-36845, CVE-2023-36846…
- [Confluence Data Center/Server reset-and-takeover bug exploited for Cerber ransomware (CVE-2023-22518)](https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518) ([json](https://pwn.watch/i/atlassian-confluence-improper-authorization-cve-2023-22518.json)): critical, closed, patched, started 2023-10-31, CVE-2023-22518
- [F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)](https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748) ([json](https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748.json)): critical, closed, patched, started 2023-10-31, CVE-2023-46747, CVE-2023-46748
- [Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)](https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515) ([json](https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json)): critical, closed, patched, started 2023-10-04, CVE-2023-22515
- [Cisco IOS XE web UI zero-days: implants on tens of thousands of devices](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198) ([json](https://pwn.watch/i/cisco-ios-xe-web-ui-implants-cve-2023-20198.json)): critical, closed, patched, started 2023-09-18, CVE-2023-20198, CVE-2023-20273
- [TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793) ([json](https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json)): critical, closed, patched, started 2023-09-18, CVE-2023-42793
- [Ivanti Sentry: Authentication Bypass (CVE-2023-38035)](https://pwn.watch/i/ivanti-sentry-cve-2023-38035) ([json](https://pwn.watch/i/ivanti-sentry-cve-2023-38035.json)): critical, closed, patched, started 2023-08-22, CVE-2023-38035
- [Veeam Backup & Replication: Cloud Connect Missing Authentication for Critical Function (CVE-2023-27532)](https://pwn.watch/i/veeam-backup-replication-cve-2023-27532) ([json](https://pwn.watch/i/veeam-backup-replication-cve-2023-27532.json)): high, closed, patched, started 2023-08-22, CVE-2023-27532
- [Ivanti EPMM zero-days used to breach 12 Norwegian ministries](https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078) ([json](https://pwn.watch/i/ivanti-epmm-norway-government-cve-2023-35078.json)): critical, closed, patched, started 2023-07-24, CVE-2023-35078, CVE-2023-35081
- [VMware Tools: Authentication Bypass (CVE-2023-20867)](https://pwn.watch/i/vmware-tools-cve-2023-20867) ([json](https://pwn.watch/i/vmware-tools-cve-2023-20867.json)): low, closed, patched, started 2023-06-23, CVE-2023-20867
- [PaperCut MF/NG auth bypass to SYSTEM RCE, used by Cl0p and LockBit (CVE-2023-27350)](https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350) ([json](https://pwn.watch/i/papercut-mf-ng-auth-bypass-cve-2023-27350.json)): critical, closed, patched, started 2023-04-21, CVE-2023-27350