Everything TechSec Headlines has reported about authentication bypass: 6 stories, newest first. Part of our Vulnerabilities coverage.
Commented-out code in Webreaper Damselfly 4.5.3 removes authentication checks, allowing unauthenticated users to create admin accounts and reset passwords.
A timing flaw in the LatePoint WordPress plugin allows attackers to bypass login limits and steal customer accounts without credentials.
Unauthenticated attackers can forge tokens using a default secret to impersonate administrators and gain full control of the platform.
Directory services treat user input as executable code, allowing attackers to bypass authentication by manipulating the query syntax rather than guessing credentials.
A critical flaw in BotSharp allows attackers to forge admin tokens using a secret key stored in the application's configuration file.
Remote attackers can seize full administrative control of TVU broadcast devices by exploiting a login flaw that ignores username requirements in older firmware versions.