Common Weakness Enumeration
CWE-306
AllowedMissing Authentication for Critical Function
Abstraction: Base · Status: Draft
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
4538 vulnerabilities reference this CWE, most recent first.
CVE-2026-90944 (GCVE-0-2026-90944)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:52 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
Summary
Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 20:22 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/krayin/laravel-crm/issues/2560 | issue-tracking |
| https://github.com/krayin/laravel-crm | product |
| https://github.com/krayin/laravel-crm/blob/v2.2.6… | technical-description |
| https://github.com/krayin/laravel-crm/blob/v2.2.6… | technical-description |
| https://www.vulncheck.com/advisories/krayin-crm-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| krayin | laravel-crm |
Affected:
0 , ≤ 2.2.6
(semver)
cpe:2.3:a:webkul:krayin_crm:*:*:*:*:*:*:*:* |
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90944",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T20:22:34.525295Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:22:41.001Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/krayin/laravel-crm/issues/2560"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/krayin/laravel-crm",
"product": "laravel-crm",
"repo": "https://github.com/krayin/laravel-crm",
"vendor": "krayin",
"versions": [
{
"lessThanOrEqual": "2.2.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webkul:krayin_crm:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:04.713Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2560",
"tags": [
"issue-tracking"
],
"url": "https://github.com/krayin/laravel-crm/issues/2560"
},
{
"tags": [
"product"
],
"url": "https://github.com/krayin/laravel-crm"
},
{
"name": "mail-routes.php at v2.2.6",
"tags": [
"technical-description"
],
"url": "https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Admin/src/Routes/Admin/mail-routes.php"
},
{
"name": "bootstrap/app.php at v2.2.6",
"tags": [
"technical-description"
],
"url": "https://github.com/krayin/laravel-crm/blob/v2.2.6/bootstrap/app.php"
},
{
"name": "VulnCheck Advisory: Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/krayin-crm-through-2.2.6-unauthenticated-email-injection-via-inbound-parse"
}
],
"title": "Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90944",
"datePublished": "2026-09-14T17:52:05.500Z",
"dateReserved": "2026-09-14T11:34:24.687Z",
"dateUpdated": "2026-09-24T14:22:04.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90938 (GCVE-0-2026-90938)
Vulnerability from cvelistv5 – Published: 2026-09-14 12:48 – Updated: 2026-09-14 13:29
VLAI
EPSS
VEX
Title
LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket
Summary
LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary "debug plugin" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker's plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering with "prod_mode": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 13:29 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/langbot-app/LangBot/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/langbot-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| langbot-app | LangBot |
Affected:
0 , ≤ 0.4.17
(semver)
cpe:2.3:a:langbot:langbot:*:*:*:*:*:*:*:* |
Date Public
2026-07-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90938",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T13:29:50.111076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:29:58.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/langbot_plugin",
"product": "LangBot",
"vendor": "langbot-app",
"versions": [
{
"lessThanOrEqual": "0.4.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:langbot:langbot:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "T4rnRookie"
}
],
"datePublic": "2026-07-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LangBot\u0027s plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary \"debug plugin\" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker\u0027s plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user\u0027s LLM pipeline. Registering with \"prod_mode\": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T12:48:32.108Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m7qm-2mjr-2h4q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/langbot-app/LangBot/security/advisories/GHSA-m7qm-2mjr-2h4q"
},
{
"name": "VulnCheck Advisory: LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/langbot-through-0.4.17-unauthenticated-plugin-registration-via-websocket"
}
],
"title": "LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90938",
"datePublished": "2026-09-14T12:48:32.108Z",
"dateReserved": "2026-09-14T11:34:24.687Z",
"dateUpdated": "2026-09-14T13:29:58.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90898 (GCVE-0-2026-90898)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:18 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Bifrost unauthenticated remote code execution via MCP stdio client registration
Summary
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.
The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:01 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maximhq/bifrost/pull/6757 | patch |
| https://github.com/maximhq/bifrost/commit/12e1703… | patch |
| https://github.com/maximhq/bifrost/releases/tag/t… | release-notes |
| https://github.com/maximhq/bifrost | product |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90898",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:01:44.207374Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:46.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/maximhq/bifrost",
"defaultStatus": "unaffected",
"modules": [
"transports/bifrost-http",
"core/mcp"
],
"packageName": "github.com/maximhq/bifrost/transports",
"platforms": [
"Linux",
"macOS"
],
"product": "Bifrost",
"programFiles": [
"transports/bifrost-http/handlers/mcp.go",
"transports/bifrost-http/handlers/middlewares.go"
],
"repo": "git://github.com/maximhq/bifrost",
"vendor": "maximhq",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eManagement API reachable and governance.auth_config.is_enabled=false, which is the documented default. Confirmed on maximhq/bifrost v1.6.3. Fixed in transports/v2.1.0 (2026-09-08). An operator who enables management authentication and keeps the admin listener off untrusted networks is not exposed to the unauthenticated form of this issue.\u003c/p\u003e"
}
],
"value": "Management API reachable and governance.auth_config.is_enabled=false, which is the documented default. Confirmed on maximhq/bifrost v1.6.3. Fixed in transports/v2.1.0 (2026-09-08). An operator who enables management authentication and keeps the admin listener off untrusted networks is not exposed to the unauthenticated form of this issue."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yuval Moravchick | JFrog"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\u003c/p\u003e\u003cp\u003eThe default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).\u003c/p\u003e\u003cp\u003e\u0026nbsp;transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.\u003c/p\u003e"
}
],
"value": "Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required.\n\n\n\nThe default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).\n\n\n\n\u00a0transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eJFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record.\u003c/p\u003e"
}
],
"value": "JFrog has a private proof of concept. An unauthenticated POST /api/mcp/client with connection_type stdio and attacker-chosen command and args starts the program in the gateway. Public exploit details are not included in this record."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:18:53.454Z",
"orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"shortName": "JFROG"
},
"references": [
{
"name": "PR #6757: refuse unauthenticated stdio MCP registration",
"tags": [
"patch"
],
"url": "https://github.com/maximhq/bifrost/pull/6757"
},
{
"name": "Merge commit for PR #6757",
"tags": [
"patch"
],
"url": "https://github.com/maximhq/bifrost/commit/12e170352bd25eab1ae9ba16611f1797d1fd8fdc"
},
{
"name": "Bifrost HTTP v2.1.0 (first release containing the fix)",
"tags": [
"release-notes"
],
"url": "https://github.com/maximhq/bifrost/releases/tag/transports/v2.1.0"
},
{
"name": "Bifrost repository",
"tags": [
"product"
],
"url": "https://github.com/maximhq/bifrost"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change.\u003c/p\u003e"
}
],
"value": "Upgrade Bifrost HTTP transport to 2.1.0 or later. PR #6757 returns 403 for unauthenticated stdio MCP client registration when dashboard authentication is disabled or unconfigured. Authenticated admins can still add stdio clients. The 1.6.x line through 1.6.11 and transports/v2.0.0 do not include this change."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-13T10:27:00.000Z",
"value": "Reported to the Bifrost maintainers (GHSA-86gf-xh3g-rvxq)"
},
{
"lang": "en",
"time": "2026-09-02T15:14:00.000Z",
"value": "Fix merged upstream (PR #6757)"
},
{
"lang": "en",
"time": "2026-09-08T15:15:00.000Z",
"value": "Fix first shipped in Bifrost HTTP v2.1.0"
}
],
"title": "Bifrost unauthenticated remote code execution via MCP stdio client registration",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSet governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Set governance.auth_config.is_enabled to true, use strong administrator credentials, and firewall the management listener."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
"assignerShortName": "JFROG",
"cveId": "CVE-2026-90898",
"datePublished": "2026-09-14T10:18:53.454Z",
"dateReserved": "2026-09-14T10:13:28.161Z",
"dateUpdated": "2026-09-14T11:19:46.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90896 (GCVE-0-2026-90896)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:58 – Updated: 2026-09-15 19:17 X_Open Source
VLAI
EPSS
VEX
Title
Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII
Summary
Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer's name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. Sibling endpoints such as POST /api/stripe/payment already enforced authentication via auth.api.getSession(); this endpoint had no access control whatsoever. The session_id is exposed in the buyer's own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer's personal data to an unauthenticated actor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:16 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/MarcosCamara01/ecommerce-templ… | patch |
| https://secur0.com/en/cna/cve-list/cve-2026-90896… | third-party-advisorytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MarcosCamara01 | Ecommerce Template |
Affected:
0 , < 91e273c
(custom)
cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90896",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:16:46.645636Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:17:02.930Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Stripe checkout_sessions API route"
],
"product": "Ecommerce Template",
"programFiles": [
"src/app/api/stripe/checkout_sessions/route.ts"
],
"repo": "https://github.com/MarcosCamara01/ecommerce-template",
"vendor": "MarcosCamara01",
"versions": [
{
"lessThan": "91e273c",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:*",
"versionEndExcluding": "91e273c",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jaime Ramirez"
},
{
"lang": "en",
"type": "analyst",
"value": "Dario Rivas Quero"
},
{
"lang": "en",
"type": "coordinator",
"value": "Secur0 CNA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (\u003ccode\u003esrc/app/api/stripe/checkout_sessions/route.ts\u003c/code\u003e), exposed at \u003ccode\u003eGET /api/stripe/checkout_sessions\u003c/code\u003e, in MarcosCamara01 Ecommerce Template before commit \u003ccode\u003e91e273c\u003c/code\u003e allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (\u003ccode\u003ecs_...\u003c/code\u003e) to retrieve the full session object, including the buyer\u0027s name, email, phone, billing address, amount paid and internal \u003ccode\u003euserId\u003c/code\u003e, because the GET handler calls \u003ccode\u003estripe.checkout.sessions.retrieve()\u003c/code\u003e and returns the result without checking for an authenticated session or session ownership. Sibling endpoints such as \u003ccode\u003ePOST /api/stripe/payment\u003c/code\u003e already enforced authentication via \u003ccode\u003eauth.api.getSession()\u003c/code\u003e; this endpoint had no access control whatsoever. The \u003ccode\u003esession_id\u003c/code\u003e is exposed in the buyer\u0027s own browser URL after payment (\u003ccode\u003esuccess_url = /result?session_id={CHECKOUT_SESSION_ID}\u003c/code\u003e), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer\u0027s personal data to an unauthenticated actor."
}
],
"value": "Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer\u0027s name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. Sibling endpoints such as POST /api/stripe/payment already enforced authentication via auth.api.getSession(); this endpoint had no access control whatsoever. The session_id is exposed in the buyer\u0027s own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer\u0027s personal data to an unauthenticated actor."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:58:39.818Z",
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MarcosCamara01/ecommerce-template/commit/91e273c69d976a3d205179e66e01fc399bfdd08b"
},
{
"tags": [
"third-party-advisory",
"technical-description"
],
"url": "https://secur0.com/en/cna/cve-list/cve-2026-90896-missing-authentication-ecommerce-template-checkout-session-pii"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to a build including commit \u003ccode\u003e91e273c\u003c/code\u003e, which requires an authenticated session (401 otherwise) and verifies that \u003ccode\u003echeckoutSession.metadata.userId\u003c/code\u003e matches the authenticated user (403 otherwise) before returning the checkout session."
}
],
"value": "Update to a build including commit 91e273c, which requires an authenticated session (401 otherwise) and verifies that checkoutSession.metadata.userId matches the authenticated user (403 otherwise) before returning the checkout session."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"assignerShortName": "Secur0",
"cveId": "CVE-2026-90896",
"datePublished": "2026-09-14T20:58:39.818Z",
"dateReserved": "2026-09-14T10:11:59.785Z",
"dateUpdated": "2026-09-15T19:17:02.930Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90620 (GCVE-0-2026-90620)
Vulnerability from cvelistv5 – Published: 2026-09-14 03:00 – Updated: 2026-09-14 14:59
VLAI
EPSS
VEX
Title
0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication
Summary
A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike_server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 14:59 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403202 | vdb-entry |
| https://vuldb.com/vuln/403202/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90620 | third-party-advisory |
| https://vuldb.com/submit/914813 | third-party-advisory |
| https://github.com/0x4m4/hexstrike-ai/issues/223 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 0x4m4 | HexStrike AI |
Affected:
d689933ff579d839c676c82b231f8e98326c5f04
cpe:2.3:a:0x4m4:hexstrike_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90620",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T14:59:27.417179Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:59:40.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:0x4m4:hexstrike_ai:*:*:*:*:*:*:*:*"
],
"modules": [
"API Command Endpoint"
],
"product": "HexStrike AI",
"vendor": "0x4m4",
"versions": [
{
"status": "affected",
"version": "d689933ff579d839c676c82b231f8e98326c5f04"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ez-lbz (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is an unknown function of the file hexstrike_server.py of the component API Command Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T03:00:11.752Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403202 | 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/403202"
},
{
"name": "VDB-403202 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403202/cti"
},
{
"name": "CVE-2026-90620 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90620"
},
{
"name": "Submit #914813 | 0x4m4 hexstrike-ai v1.0 rce",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/914813"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/0x4m4/hexstrike-ai/issues/223"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T22:24:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90620",
"datePublished": "2026-09-14T03:00:11.752Z",
"dateReserved": "2026-09-12T20:17:19.176Z",
"dateUpdated": "2026-09-14T14:59:40.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90579 (GCVE-0-2026-90579)
Vulnerability from cvelistv5 – Published: 2026-09-13 19:00 – Updated: 2026-09-14 17:08
VLAI
EPSS
VEX
Title
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
Summary
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 17:05 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403164 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403164/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90579 | third-party-advisory |
| https://vuldb.com/submit/913219 | third-party-advisory |
| https://github.com/cheshire-cat-ai/core/issues/1137 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cheshire-cat-ai | Cheshire Cat AI |
Affected:
1.9.0
Affected: 1.9.1 Affected: 1.9.2 cpe:2.3:a:cheshire-cat-ai:cheshire_cat_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90579",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T17:05:52.874522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:08:09.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:cheshire-cat-ai:cheshire_cat_ai:*:*:*:*:*:*:*:*"
],
"product": "Cheshire Cat AI",
"vendor": "cheshire-cat-ai",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "affected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "geochen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T19:00:09.701Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403164 | cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403164"
},
{
"name": "VDB-403164 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403164/cti"
},
{
"name": "CVE-2026-90579 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90579"
},
{
"name": "Submit #913219 | https://github.com/cheshire-cat-ai core v1.9.2 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/913219"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cheshire-cat-ai/core/issues/1137"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T18:43:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90579",
"datePublished": "2026-09-13T19:00:09.701Z",
"dateReserved": "2026-09-12T16:38:13.983Z",
"dateUpdated": "2026-09-14T17:08:09.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90543 (GCVE-0-2026-90543)
Vulnerability from cvelistv5 – Published: 2026-09-12 12:08 – Updated: 2026-09-14 18:27
VLAI
EPSS
VEX
Title
WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
Summary
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the `key` and `msg` parameters from $_REQUEST, resolves the stream owner via LiveTransmition::keyExists, and verifies that the stream owner (not the caller) is an administrator; it performs no User::isLogged() check and enforces no CSRF token. As a result, an unauthenticated remote attacker who knows an administrator's Live stream key can call sendSocketSuccessMessageToUsers_id and deliver arbitrary in-app/socket notification messages to that administrator. The issue was unpatched at the time of publication.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 18:26 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/WWBN/AVideo/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/wwbn-avideo-… | third-party-advisory |
| https://github.com/WWBN/AVideo/security/advisorie… | exploit |
Impacted products
Date Public
2026-08-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90543",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T18:26:52.625998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T18:27:32.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-vr35-39vf-9qp9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AVideo",
"vendor": "WWBN",
"versions": [
{
"lessThanOrEqual": "c3edcc274c389816d434acadac07ee78eaf330c1",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "santhreal"
}
],
"datePublic": "2026-08-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the `key` and `msg` parameters from $_REQUEST, resolves the stream owner via LiveTransmition::keyExists, and verifies that the stream owner (not the caller) is an administrator; it performs no User::isLogged() check and enforces no CSRF token. As a result, an unauthenticated remote attacker who knows an administrator\u0027s Live stream key can call sendSocketSuccessMessageToUsers_id and deliver arbitrary in-app/socket notification messages to that administrator. The issue was unpatched at the time of publication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-12T12:08:49.742Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wcg2-x62c-m28x)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wcg2-x62c-m28x"
},
{
"name": "VulnCheck Advisory: WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wwbn-avideo-missing-authentication-via-socketmessageliveowner-json-php"
}
],
"title": "WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90543",
"datePublished": "2026-09-12T12:08:49.742Z",
"dateReserved": "2026-09-12T11:13:17.618Z",
"dateUpdated": "2026-09-14T18:27:32.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90524 (GCVE-0-2026-90524)
Vulnerability from cvelistv5 – Published: 2026-09-13 13:30 – Updated: 2026-09-15 13:59 X_Open Source
VLAI
EPSS
VEX
Title
jaychouchannel Tourism-Management-System Update Endpoint missing authentication
Summary
A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 84d8ec384f669df3985293dab293bb7b477efa64. It is suggested to install a patch to address this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 13:47 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403114 | vdb-entry |
| https://vuldb.com/vuln/403114/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90524 | third-party-advisory |
| https://vuldb.com/submit/912245 | third-party-advisory |
| https://github.com/jaychouchannel/Tourism-Managem… | exploitissue-tracking |
| https://github.com/jaychouchannel/Tourism-Managem… | patch |
| https://github.com/jaychouchannel/Tourism-Managem… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jaychouchannel | Tourism-Management-System |
Affected:
229956e20dbd4a80eeff14535e44d3099502af09
cpe:2.3:a:jaychouchannel:tourism-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90524",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T13:47:33.248578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T13:59:55.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:jaychouchannel:tourism-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Update Endpoint"
],
"product": "Tourism-Management-System",
"vendor": "jaychouchannel",
"versions": [
{
"status": "affected",
"version": "229956e20dbd4a80eeff14535e44d3099502af09"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Chenshiyi (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 84d8ec384f669df3985293dab293bb7b477efa64. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T13:30:16.020Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403114 | jaychouchannel Tourism-Management-System Update Endpoint missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/403114"
},
{
"name": "VDB-403114 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403114/cti"
},
{
"name": "CVE-2026-90524 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90524"
},
{
"name": "Submit #912245 | jaychouchannel Tourism_Management_System 8122bf020d91199eddfff3ee02d1632a70a9a132 Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/912245"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jaychouchannel/Tourism-Management-System/issues/11"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jaychouchannel/Tourism-Management-System/commit/84d8ec384f669df3985293dab293bb7b477efa64"
},
{
"tags": [
"product"
],
"url": "https://github.com/jaychouchannel/Tourism-Management-System/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T13:00:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "jaychouchannel Tourism-Management-System Update Endpoint missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90524",
"datePublished": "2026-09-13T13:30:16.020Z",
"dateReserved": "2026-09-12T10:55:04.755Z",
"dateUpdated": "2026-09-15T13:59:55.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90513 (GCVE-0-2026-90513)
Vulnerability from cvelistv5 – Published: 2026-09-13 10:45 – Updated: 2026-09-14 16:24
VLAI
EPSS
VEX
Title
simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication
Summary
A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument toEmails/ccEmails/replyToEmails/subject/message causes missing authentication. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 16:23 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403100 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403100/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90513 | third-party-advisory |
| https://vuldb.com/submit/911886 | third-party-advisory |
| https://github.com/simalexan/api-lambda-send-emai… | issue-tracking |
| https://github.com/simalexan/api-lambda-send-email-ses/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simalexan | api-lambda-send-email-ses |
Affected:
bda6869aa81371d1e872242e74fe7d953edb818d
cpe:2.3:a:simalexan:api-lambda-send-email-ses:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90513",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T16:23:50.618482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T16:24:01.118Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:simalexan:api-lambda-send-email-ses:*:*:*:*:*:*:*:*"
],
"modules": [
"API Gateway Endpoint"
],
"product": "api-lambda-send-email-ses",
"vendor": "simalexan",
"versions": [
{
"status": "affected",
"version": "bda6869aa81371d1e872242e74fe7d953edb818d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "changli (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d. This issue affects the function SES.sendEmail of the file template.yml of the component API Gateway Endpoint. This manipulation of the argument toEmails/ccEmails/replyToEmails/subject/message causes missing authentication. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T10:45:06.465Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403100 | simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403100"
},
{
"name": "VDB-403100 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403100/cti"
},
{
"name": "CVE-2026-90513 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90513"
},
{
"name": "Submit #911886 | simalexan api-lambda-send-email-ses Git commit bda6869aa81371d1e872242e74fe7d953edb818d and earlier Missing Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/911886"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/simalexan/api-lambda-send-email-ses/issues/9"
},
{
"tags": [
"product"
],
"url": "https://github.com/simalexan/api-lambda-send-email-ses/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T11:28:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90513",
"datePublished": "2026-09-13T10:45:06.465Z",
"dateReserved": "2026-09-12T09:23:22.185Z",
"dateUpdated": "2026-09-14T16:24:01.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90504 (GCVE-0-2026-90504)
Vulnerability from cvelistv5 – Published: 2026-09-13 08:45 – Updated: 2026-09-21 16:18 Unsupported When Assigned
VLAI
EPSS
VEX
Title
vvbbnn00 WARP-Clash-API authorized missing authentication
Summary
A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:15 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403092 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403092/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90504 | third-party-advisory |
| https://vuldb.com/submit/895263 | third-party-advisory |
| https://gist.github.com/Galaxync/b90734d80bf32e81… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vvbbnn00 | WARP-Clash-API |
Affected:
c7bf2360073959861219b422e51ae86411051b46
cpe:2.3:a:vvbbnn00:warp-clash-api:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90504",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:15:37.386132Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:18:29.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:vvbbnn00:warp-clash-api:*:*:*:*:*:*:*:*"
],
"product": "WARP-Clash-API",
"vendor": "vvbbnn00",
"versions": [
{
"status": "affected",
"version": "c7bf2360073959861219b422e51ae86411051b46"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Galaxyn (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-13T08:45:08.782Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403092 | vvbbnn00 WARP-Clash-API authorized missing authentication",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403092"
},
{
"name": "VDB-403092 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403092/cti"
},
{
"name": "CVE-2026-90504 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90504"
},
{
"name": "Submit #895263 | vvbbnn00 (https://github.com/vvbbnn00) WARP-Clash-API latest (main/master branch) CWE-306 (Missing Authentication for Critical Function - endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/895263"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Galaxync/b90734d80bf32e8145e46fbc326d6729"
}
],
"tags": [
"unsupported-when-assigned"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-12T10:52:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "vvbbnn00 WARP-Clash-API authorized missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90504",
"datePublished": "2026-09-13T08:45:08.782Z",
"dateReserved": "2026-09-12T08:46:41.383Z",
"dateUpdated": "2026-09-21T16:18:29.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
- Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
- In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
Architecture and Design
- Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
- In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
Implementation
System Configuration
Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
CAPEC-12: Choosing Message Identifier
This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.
CAPEC-166: Force the System to Reset Values
An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.
CAPEC-216: Communication Channel Manipulation
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.
CAPEC-36: Using Unpublished Interfaces or Functionality
An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.