CVE-2026-118741
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVSS
8.1
Alta
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-640
Ainda não há histórico EPSS suficiente.
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-600467.5 ALT24.9%
——7An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.13hCVE-2026-1250747.3 ALT22.2%
——7A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.1dCVE-2026-118459—25.5%
——8A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.2dCVE-2026-1231968.1 ALT29.7%
——9Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts.2dCVE-2026-114421—23.1%
——7SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.1dCVE-2026-1191278.1 ALT20.4%
——6ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name can point the links in genuine emails at their host, harvest the single-use codes when the links are opened, and take over accounts including instance administrators.7d