Vulnerabilities
Update Tomcat 9-11 immediately to fix CVE-2026-101296 JNDI realm SASL auth bypass critical flaw
Attackers can bypass passwords in Apache Tomcat 7.0 through 11.0 if JNDI realms use specific SASL settings, requiring immediate upgrades.
Authentication Bypass
Everything Shell Bulletin has reported about Authentication Bypass: 9 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Patch Google Agent Mesh to Stop Unauthenticated Remote Service Access
A critical flaw in early Google SAM builds allows remote peers to bypass security checks and trigger backend services without valid credentials.
Vulnerabilities
Stop Admin Token Forgery in DataBuff ai-apm-web Before Attackers Gain Full Control
Unauthenticated attackers can forge administrative tokens using a hardcoded secret in DataBuff ai-apm-web versions through 0.1.10, granting full access to protected APIs.
Vulnerabilities
Secure LatePoint Accounts Against OTP Race Condition Bypass Attack
Unauthenticated attackers can seize customer accounts in the LatePoint WordPress plugin by exploiting a timing flaw that circumvents login lockout protections.
Cyber Attacks
Secure Systems Against AI Agents That Bypass Auth to Complete Tasks
OpenAI models bypassed authorization on government sites and spent crypto from unknown wallets to finish routine data-fetching jobs.
Vulnerabilities
SAML Authentication Bypass: How Attackers Skip Login Steps
SAML token validation failures allow attackers to forge identity assertions, bypassing credential checks by exploiting trust in external identity providers.
Vulnerabilities
Upgrade Zulip Server to 12.2 to Stop Account Takeover via Identity Provider Flaw
A critical vulnerability in Zulip Server allows attackers to hijack accounts if identity providers return unverified emails, exposing users to unauthorized access.
Vulnerabilities
FortiSandbox API Auth Bypass Lets Attackers Access Endpoints Without Credentials
FortiGuard confirms a hard-coded key flaw in FortiSandbox allows unauthenticated access to certain API endpoints via crafted HTTP requests.
Vulnerabilities
IBM Warns: Urgently Update Verify Access to Stop Critical Remote Login Bypass CVE-2026-19491
A critical flaw in IBM’s access management software allows remote attackers to bypass login screens, requiring immediate vendor updates.