# authentication bypass Published articles for authentication bypass. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Cisco drops another exploited zero-day, this time a perfect 10 DevFeed: [Cisco drops another exploited zero-day, this time a perfect 10]() Original publisher: [Read original article]() Author: Carly Page Published: 2026-09-17T12:40:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [Cisco](), [Authentication](), [Security](), [patches]() Tags: [authentication-bypass](), [cisco](), [cybersecurity](), [security](), [zero-day]() ### AI overview Cisco's ISE authentication bypass is under active attack, following another Cisco zero-day that prompted administrators to urgently apply patches. ### Source excerpt ISE authentication bypass under active attack just days after another Cisco zero-day sent admins scrambling to patch ## pgAdmin 4 v9.18 Released DevFeed: [pgAdmin 4 v9.18 Released]() Original publisher: [Read original article]() Author: Pgadmin Development Team Published: 2026-09-17T00:00:00Z Content type: release Language: en Sources: [PostgreSQL news]() Topics: [releases](), [Security](), [Vulnerabilities](), [Authentication](), [PostgreSQL](), [GUI](), [vs-code](), [React]() Tags: [2026](), [announce](), [authentication-bypass](), [bug-fixes](), [cve](), [database](), [react](), [security](), [security-vulnerabilities](), [vs-code]() ### AI overview The pgAdmin Development Team announces pgAdmin 4 version 9.18, a release containing 29 bug fixes and new features, including fixes for four security vulnerabilities. Changes include Object Explorer improvements, a hardened Content-Security-Policy, and fixes for authentication bypass and connection-string or argument injection issues in database-management tools. ### Source excerpt The pgAdmin Development Team is pleased to announce the release of pgAdmin 4 version 9.18. This release of pgAdmin 4 includes 29 bug fixes and new features, including fixes for four security vulnerabilities (CVE-2026-86861 through CVE-2026-86864). For more details, please see the release notes. pgAdmin is the leading open-source graphical management tool for PostgreSQL. For more information, please see the website. Notable changes in this release include: Features Collapse and restore the Object Explorer by re-clicking the current workspace icon, in the manner of the VS Code side bar, remembering the choice across refreshes. A keyboard shortcut, Ctrl+Alt+B by default, does the same thing and can be changed through the new toggle_object_explorer preference. Harden the default Content-Security-Policy so inline scripts run under a per-request nonce rather than a blanket 'unsafe-inline', and drop 'unsafe-eval'. style-src keeps 'unsafe-inline', because MUI and React inject runtime styles and inline style attributes that cannot carry a nonce, and development bundles have 'unsafe-eval' re-added automatically when DEBUG is set. Security Fixes Fix an authentication bypass in Webserver authentication mode, where get_user() fell back to reading the configured WEBSERVER_REMOTE_USER name from the inbound request headers when it was absent from the WSGI environment. Because a header is written by whoever sends the request, any client that could reach pgAdmin could assert any identity, including an administrator's, without presenting a credential. A header-asserted identity is now opt-in, restricted to a configured list of trusted proxies with an optional shared secret, and refused for accounts whose authentication source is not webserver (CVE-2026-86863). Fix argument and connection-string injection in the Backup tool, where the client-supplied database name was appended to the pg_dump argument vector as a bare positional value. Because getopt_long permutes arguments, a value beg ## Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices DevFeed: [Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices]() Original publisher: [Read original article]() Author: Simone Margaritelli Published: 2026-04-01T22:00:00Z Content type: article Language: en Sources: [evilsocket]() Topics: [Mongoose](), [Vulnerabilities](), [Security](), [Embedded Systems](), [Internet of things](), [C](), [cross-platform](), [HTTP](), [MQTT](), [WebSocket]() Tags: [authentication-bypass](), [buffer-overflow](), [c](), [cesanta](), [cross-platform](), [cve](), [cve-2026-5244](), [cve-2026-5245](), [cve-2026-5246](), [cybersecurity](), [embedded](), [embedded-devices](), [embedded-systems](), [exploit](), [heap-overflow](), [http](), [https](), [industrial-control](), [iot](), [iot-security](), [library](), [mdns](), [mips](), [mongoose](), [mqtt](), [mtls](), [rce](), [responsible-disclosure](), [security](), [stack-overflow](), [tls](), [vulnerability-research]() ### AI overview The article reports three independently exploitable vulnerabilities in Mongoose v7.20, an embedded C networking library used in IoT devices: an mTLS authentication bypass, a preauthentication heap-overflow RCE through client public-key parsing, and a preauthentication RCE through mDNS over UDP. Mongoose v7.21 reportedly includes patches for the issues, which were assigned CVE-2026-5244, CVE-2026-5245, and CVE-2026-5246. ### Source excerpt So, Mongoose. I