CVE-2026-40995
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, wit
CVSS
5.4
Medio
EPSS
0.1%
p5
KEV
—
Exploit Today
1
0-100
Publicado: 11 jun 2026 · Última mod.: 23 jul 2026 · CWE-287
0.1%EPSS · 30 días0.1%
2026-07-022026-07-29
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-283239.8 CRÍ—
———SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.7hCVE-2026-580669.8 CRÍ—
——0Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside any valid signature made by the trusted IdP certificate, and log in as an arbitrary user.7hCVE-2026-568504.1 MED—
——0A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.9hCVE-2026-152407.5 ALT—
——0The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.11hCVE-2026-143055.3 MED—
——0The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.12hCVE-2026-632386.5 MED11.9%
——4An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated
attacker to take over any account, including administrator accounts, by
supplying a valid user UUID without providing primary credentials via the 2FA
validation endpoint.9h