#Missing Authentication
All CosmicBytez Labs articles tagged #Missing Authentication, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-118690: Signal K Server Unauthenticated Log Download Leads to Admin Takeover
Signal K Server before 2.33.0 exposes /skServer/ziplogs without authentication, letting attackers steal the JWT secret and forge admin tokens (CVSS 9.8).
- Security
CVE-2026-46651 — Goobi viewer Unauthenticated WebSocket Download Endpoint (SSRF/LFI)
Goobi viewer 24.03 to before 26.05 exposes a WebSocket download endpoint without authentication, enabling SSRF and local file inclusion (CVSS 9.8).
- Security
CVE-2026-105279: dcm4chee-arc-light DICOM Archive Accepts Unauthenticated Peer Connections
dcm4chee-arc-light trusts any DICOM peer by default, letting attackers enumerate patients, pull images, and plant fabricated studies.
- Security
CVE-2026-105038: EnergizeLab Eilik/EilikO Unauthenticated AI Model Admin
EnergizeLab's Eilik/EilikO companion robots expose AI model admin functions with no auth, letting anyone swap the model at runtime (CVSS 9.8).
- Security
CVE-2026-107779: Dromara Skyeye Unauthenticated RCE via Bundled xxl-job-admin
Unauthenticated POSTs to Skyeye's bundled xxl-job-admin let attackers run arbitrary GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs for remote code execution.
- Security
CVE-2026-63688: Missing Authentication in Dell CSM Authorization gRPC Server Exposes Storage Array Credentials
An unauthenticated gRPC server in Dell CSM Authorization lets attackers retrieve admin credentials for every registered storage array.
- Security
CVE-2026-63692: Dell CSM Authorization Proxy Missing Authentication Allows Cross-Tenant Admin Takeover
A missing authentication flaw in Dell CSM's authorization proxy lets unauthenticated attackers gain admin privileges across tenants.
- Security
CVE-2026-105105: NASA AIT-Core ZeroMQ Broker Unauthenticated Command Injection
AIT-Core's ait-server ZeroMQ broker binds without authentication, letting a network attacker inject spacecraft commands and forge telemetry.
- Security
CVE-2026-95102: Critical Missing Authentication in Monta EV Charging Platform's WebSocket Endpoints
CVSS 9.4: Monta EV charging WebSocket endpoints lack authentication, allowing attackers to impersonate charging stations.
- Security
CVE-2026-49364: Apache ActiveMQ Artemis Cluster Credential Exposure
A pre-auth flaw in Artemis cluster discovery lets network-adjacent attackers capture admin credentials during the connection handshake.
- Security
CVE-2026-57967: Apache ActiveMQ Artemis Session Hijack via CORE Protocol
Attackers can craft a CORE protocol SESSION_REATTACH packet to steal an existing Artemis session and its authenticated privileges.
- Security
CVE-2026-67593: Apache ActiveMQ Artemis Unauthenticated Queue Deletion
A crafted OpenWire RemoveSubscriptionInfo command lets unauthenticated attackers delete Artemis broker queues before login completes.
- Security
CVE-2026-14622: Missing Authentication in Restaurant Website PHP/MySQL AJAX Endpoint
A missing authentication vulnerability (CVSS 7.3) in the jairiidriss/restaurant-website-php-mysql project exposes the /admin/ajax_files endpoint to...
- Security
CVE-2026-6577: DjangoBlog Missing Authentication in OwnTracks logtracks Endpoint
A missing authentication vulnerability in liangliangyy DjangoBlog up to 2.1.0.0 allows unauthenticated remote attackers to access the logtracks endpoint...
- Security
CVE-2026-4312: DrangSoft GCB/FCB Audit Software Missing
A critical missing authentication flaw (CVSS 9.8) in DrangSoft's GCB/FCB Audit Software allows unauthenticated remote attackers to directly access...