CVE-2026-13140

VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record.

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification binds an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the new address with email_verified set to true.

Yuxi from 0.6.0.beta1 until 0.7.1 has insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials.

Readest prior to 0.11.10 contains an unauthenticated /api/opds/proxy route that fetches an attacker-controlled URL server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during redirects. The route also accepts caller-controlled outbound headers and Authorization values and reflects the upstream status and response body.

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files.

GPUStack prior to 2.2.0 treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1, allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution.

GPUStack from 0.7.1 until 2.2.2 contains an /auth/saml/callback endpoint that decodes SAML XML and uses its NameID and attributes to resolve or provision a user without verifying the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new account, even when SAML was not configured.

IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain a use-after-free vulnerability that could allow a remote attacker to execute arbitrary code.

A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1 in an unknown functionality of /usr/bin/webmgnt within the Multipart Parser component. Manipulating the filename argument results in path traversal, the attack can be initiated remotely, the exploit is public, and the vendor did not respond.