CVE-2026-82744
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 1, 2026 · Last modified: Sep 1, 2026 · CWE-636
Not enough EPSS history yet.
Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex) evaluated those guards in apply_where_clauses/3, and apply_validation rescued any exception into {:error, error}. The reduce treated that identically to a guard whose condition was simply not met and bypassed the change. So when a guard raises (for example on attacker-influenced input), a change that enforces a security-relevant modification is skipped rather than failing the step. The fix distinguishes a raised exception (now {:raised, error}) and halts the step with an error, failing closed. This issue affects ash: from 3.0.0-rc.17 before 3.32.2.
- cna.erlef.orghttps://cna.erlef.org/cves/CVE-2026-82744.html
- github.comhttps://github.com/ash-project/ash/commit/6d2eb86ea8d2ba5ffac89c1b8b9bf46e331feabc
- github.comhttps://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88
- osv.devhttps://osv.dev/vulnerability/EEF-CVE-2026-82744
- github.comhttps://github.com/ash-project/ash/security/advisories/GHSA-3xq4-m876-fr88
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-464825.3 MED25.4%
——8### Impact
The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value.
[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
### Details
The public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` — expected to match the question session identifier (`mybb_questionsessions.sid`) — and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error.
### Patches
MyBB 1.8.(...) resolves this issue with the following changes:
- Commit: https://github.com/mybb/mybb/commit/
- `.patch`: https://github.com/mybb/mybb/commit/.patch
### References
- Release Notes: https://mybb.com/versions/1.8.(...)/
### For more information
Go to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB.
### Contact
The security team can be reached at [security@mybb.com](mailto:security@mybb.com).14dCVE-2026-73421—38.1%
——11NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.15dCVE-2026-704527.4 HIG38.3%
——11rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.18dCVE-2026-693068.2 HIG34.3%
——10Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.4dCVE-2026-687468.8 HIG37.3%
——11Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams.
A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the deployment group it belongs to, and resolves that identifier against a locally cached list of deployment groups on every request in order to decide whether Teams identity enforcement is active. Livebook.Hubs.TeamClient.handle_call/3 in lib/livebook/hubs/team_client.ex does not distinguish a deployment group that could not be resolved from one that was resolved with identity enforcement switched off: the clause matches only the case where a group was found with enforcement enabled, and falls through to a catch-all that reports enforcement as switched off for everything else. The two neighbouring functions that decide user and application access resolve the same identifier and treat the same unresolved result as a denial.
When the identity status is reported as switched off, Livebook.ZTA.LivebookTeams.authenticate/3 in lib/livebook/zta/livebook_teams.ex returns empty identity metadata and allows the request to continue instead of halting it. LivebookWeb.UserPlug.build_current_user/3 merges that empty metadata into a newly built user, whose access type defaults to full access, and LivebookWeb.AuthPlug.authorized?/1 grants access to any user holding full access.
The cached identifier becomes unresolvable when the deployment group it refers to is deleted while the agent is not connected to receive the change, most concretely when a deployment group is deleted during the window in which an agent is disconnected or reconnecting. The client removes the group from its cached list without clearing the identifier that refers to it. Any client able to reach the affected server over the network is then granted the same access as a fully privileged member of the organisation, including the ability to read notebooks and configured secrets, execute code on the server's runtime, and disrupt its operation.
This issue affects livebook: from 0.19.7 before 0.19.9.22dCVE-2026-440948.6 HIG17.3%
——5An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.33d