CVE-2026-19863
CriticalCVSS 9.3Summary
In EthereumAuthenticator, an unauthenticated client may access certain protected resources if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page, which may replace authentication or role requirements with ALLOWED.
Risk Assessment
The vulnerability could allow unauthenticated users to access protected resources, leading to a breach of data confidentiality and integrity. Organizations using EthereumAuthenticator are exposed to authentication bypass.
Recommendation
Update EthereumAuthenticator to a patched version or adjust the configuration to avoid overlapping paths. Check for any unauthorized access to protected resources.
Related vulnerabilities
- CVE-2026-109694Critical
The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.
- CVE-2026-108497Critical
The Amelia Booking plugin (up to 2.4.10) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker could execute arbitrary SQL queries, potentially leading to data leakage or modification.
- CVE-2026-50619Critical
A path traversal vulnerability has been reported in Qsirch, which could allow remote attackers to read unexpected files or system data. The vulnerability has been fixed in version 7.0.3.0 and later.
- CVE-2026-50612Critical
A Unix symbolic link (symlink) following vulnerability has been reported in QuMagie. If a remote attacker gains a user account, they can exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in version 2.9.2 and later.
- CVE-2026-47786Critical
An OS command injection vulnerability has been reported in HybridDesk Station, which could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in versions 4.2.23 and 4.3.4 and later.
- CVE-2026-34006Critical
A missing authentication for critical function vulnerability has been reported in sMedio DTCP MOVE, which could allow remote attackers to gain access to the system. The vulnerability has been fixed in version 1.4.5 and later.
- CVE-2026-16438Critical
Mitsubishi Electric products (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, MC Works64) versions 10.97.3 and prior contain an incorrect privilege assignment vulnerability. Installers grant default DCOM permissions to the administrator account, allowing an attacker to locally or remotely launch and operate DCOM objects that should require UAC elevation.
- CVE-2026-16436Critical
Mitsubishi Electric products (GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz) contain a weak password recovery mechanism for forgotten passwords. The challenge response used to unlock the system is common to all users and fixed, allowing a remote attacker to unlock the system after obtaining it.
- CVE-2026-102469Critical
The Vert.x DB2 client (vertx-db2-client) deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call without an ObjectInputFilter or class allowlist. A malicious or man-in-the-middle DRDA server can send a response with a column tagged as UDT (FDOCA LID 0x50), causing deserialization of attacker-controlled bytes. TLS is disabled by default, making man-in-the-middle exploitation feasible.
- CVE-2026-101287Critical
Authentication bypass vulnerability in Stela versions prior to 1.60.1 due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these client-modifiable values to complete the login process.
Original NVD description (English source)
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS