[?] Related tags:
One crafted request to an unauthenticated API endpoint hands an attacker the box that decides who is allowed on your network -- and then root on it. CVSS 10.0, exploited as a zero-day, in CISA KEV on September 16 with a three-day federal deadline, and no workaround that does not involve an ACL.
A default-configuration authentication weakness in JFrog Artifactory lets an unauthenticated attacker mint administrator tokens. Patched on August 28, exploited in the wild by September 1, in CISA KEV by September 2 -- and the box it compromises is the one your entire build pipeline trusts.
Four separate failures in SharePoint's JWT validation pipeline let an unauthenticated attacker forge a token for any user -- including a site administrator -- and CISA added it to the KEV catalog on August 18 after exploitation followed the public PoC within a day.
A logic flaw in Check Point Security Gateway's deprecated IKEv1 VPN lets unauthenticated attackers establish a Remote Access VPN session without a valid password -- exploited as a zero-day by a Qilin ransomware affiliate and listed in CISA KEV
Critical pre-authentication flaw in Cisco Integrated Management Controller lets remote attackers reset any admin password and seize full out-of-band control of UCS servers
Critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager actively exploited - Unauthenticated access with netadmin privileges possible
root@sekurity:~# echo "End of results for tag: Authentication Bypass"
End of results for tag: Authentication Bypass
root@sekurity:~# _