Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-22731

Summary
Assigner-vmware
Assigner Org ID-dcf2e128-44bd-42ed-91e8-88f912c1401d
Published At-19 Mar, 2026 | 22:36
Updated At-20 Mar, 2026 | 15:33
Rejected At-
Credits

Authentication Bypass under Actuator Health groups paths

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:vmware
Assigner Org ID:dcf2e128-44bd-42ed-91e8-88f912c1401d
Published At:19 Mar, 2026 | 22:36
Updated At:20 Mar, 2026 | 15:33
Rejected At:
▼CVE Numbering Authority (CNA)
Authentication Bypass under Actuator Health groups paths

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

Affected Products
Vendor
VMware (Broadcom Inc.)Spring
Product
Spring Boot
Default Status
unaffected
Versions
Affected
  • From 4.0 before 4.0.3 (custom)
  • From 3.5 before 3.5.11 (custom)
  • From 3.4 before 3.4.15 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-288CWE-288 Authentication bypass using an alternate path or channel
Type: CWE
CWE ID: CWE-288
Description: CWE-288 Authentication bypass using an alternate path or channel
Metrics
VersionBase scoreBase severityVector
3.18.2HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Version: 3.1
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://spring.io/security/cve-2026-22731
N/A
Hyperlink: https://spring.io/security/cve-2026-22731
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@vmware.com
Published At:19 Mar, 2026 | 23:16
Updated At:16 Apr, 2026 | 04:30

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15. This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.2HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Primary3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Type: Primary
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches

VMware (Broadcom Inc.)
vmware
>>spring_boot>>Versions from 3.4.0(inclusive) to 3.4.15(exclusive)
cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
VMware (Broadcom Inc.)
vmware
>>spring_boot>>Versions from 3.5.0(inclusive) to 3.5.12(exclusive)
cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
VMware (Broadcom Inc.)
vmware
>>spring_boot>>Versions from 4.0.0(inclusive) to 4.0.4(exclusive)
cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-288Secondarysecurity@vmware.com
CWE-306Primarynvd@nist.gov
CWE ID: CWE-288
Type: Secondary
Source: security@vmware.com
CWE ID: CWE-306
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://spring.io/security/cve-2026-22731security@vmware.com
Vendor Advisory
Hyperlink: https://spring.io/security/cve-2026-22731
Source: security@vmware.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

110Records found

CVE-2025-67507
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-8.1||HIGH
EPSS-0.31% / 23.39%
||
7 Day CHG~0.00%
Published-10 Dec, 2025 | 00:43
Updated-04 Mar, 2026 | 20:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Filament's multi-factor authentication (app) recovery codes can be used multiple times

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.

Action-Not Available
Vendor-filamentphpfilamentphp
Product-filamentfilament
CWE ID-CWE-287
Improper Authentication
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2022-26925
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-8.1||HIGH
EPSS-10.46% / 95.25%
||
7 Day CHG~0.00%
Published-10 May, 2022 | 20:33
Updated-30 Oct, 2025 | 19:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2022-07-22||Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
Windows LSA Spoofing Vulnerability

Windows LSA Spoofing Vulnerability

Action-Not Available
Vendor-Microsoft Corporation
Product-windows_7windows_server_2012windows_10_21h2windows_10_1809windows_server_2022windows_rt_8.1windows_8.1windows_10_1507windows_10_1909windows_server_2008windows_10_21h1windows_10_20h2windows_10_1607windows_server_20h2windows_server_2019windows_11_21h2windows_server_2016Windows 11 version 21H2Windows Server 2016 (Server Core installation)Windows Server 2012Windows 8.1Windows Server 2008 Service Pack 2Windows Server 2019 (Server Core installation)Windows 7Windows 10 Version 21H1Windows Server 2008 Service Pack 2 (Server Core installation)Windows 10 Version 1909Windows Server 2012 (Server Core installation)Windows Server 2022Windows Server 2019Windows 10 Version 1507Windows 10 Version 1607Windows 10 Version 21H2Windows Server 2008 Service Pack 2Windows 7 Service Pack 1Windows Server 2012 R2Windows 10 Version 1809Windows Server 2008 R2 Service Pack 1 (Server Core installation)Windows Server 2012 R2 (Server Core installation)Windows 10 Version 20H2Windows Server 2008 R2 Service Pack 1Windows Server 2016Windows Server version 20H2Windows
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2023-27267
Matching Score-4
Assigner-SAP SE
ShareView Details
Matching Score-4
Assigner-SAP SE
CVSS Score-9||CRITICAL
EPSS-14.20% / 96.18%
||
7 Day CHG~0.00%
Published-11 Apr, 2023 | 02:36
Updated-07 Feb, 2025 | 19:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.

Action-Not Available
Vendor-SAP SE
Product-diagnostics_agentDiagnostics Agent (OSCommand Bridge)
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2026-50194
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-8.2||HIGH
EPSS-0.24% / 14.88%
||
7 Day CHG~0.00%
Published-17 Jun, 2026 | 21:03
Updated-22 Jun, 2026 | 18:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware responsible for restricting access to the endpoints uses the `Host` HTTP header rather than the actual network socket port. Versions 3.4.0 and 4.2.0 patch the issue. If an immediate upgrade to a patched version is not possible, add explicit ASP.NET Core authorization (`RequireAuthorization`) to all sensitive actuator endpoints as a defense-in-depth measure independent of port isolation and/or configure the reverse proxy or load balancer to enforce the `Host` header value and prevent clients from setting an arbitrary port.

Action-Not Available
Vendor-SteeltoeOSS
Product-Steeltoe.Management.EndpointCoreSteeltoe.Management.Endpoint
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CWE ID-CWE-639
Authorization Bypass Through User-Controlled Key
CVE-2022-1070
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-8.2||HIGH
EPSS-0.66% / 47.39%
||
7 Day CHG~0.00%
Published-21 Oct, 2022 | 15:39
Updated-17 Apr, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
CHANNEL ACCESSIBLE BY NON-ENDPOINT CWE-300

Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.

Action-Not Available
Vendor-Aethon, Inc.
Product-tug_home_base_serverTUG Home Base Server
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE ID-CWE-306
Missing Authentication for Critical Function
CWE ID-CWE-862
Missing Authorization
CVE-2022-0993
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-8.1||HIGH
EPSS-7.29% / 93.68%
||
7 Day CHG~0.00%
Published-19 Apr, 2022 | 20:26
Updated-08 Apr, 2026 | 18:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.

Action-Not Available
Vendor-sitegroundsiteground
Product-siteground_securitySecurity Optimizer – The All-In-One Protection Plugin
CWE ID-CWE-285
Improper Authorization
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2021-43935
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-8.1||HIGH
EPSS-1.08% / 61.31%
||
7 Day CHG~0.00%
Published-15 Dec, 2021 | 18:05
Updated-16 Sep, 2024 | 23:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products

The impacted products, when configured to use SSO, are affected by an improper authentication vulnerability. This vulnerability allows the application to accept manual entry of any active directory (AD) account provisioned in the application without supplying a password, resulting in access to the application as the supplied AD account, with all associated privileges.

Action-Not Available
Vendor-Hill-Rom Holdings, Inc.Baxter International, Inc.
Product-welch_allyn_q-stress_cardiac_stress_testing_systemwelch_allyn_connex_cardiowelch_allyn_q-stress_cardiac_stress_testing_system_firmwarewelch_allyn_hscribe_holter_analysis_systemwelch_allyn_diagnostic_cardiology_suitewelch_allyn_xscribe_cardiac_stress_testing_systemwelch_allyn_vision_express_holter_analysis_systemwelch_allyn_xscribe_cardiac_stress_testing_system_firmwarewelch_allyn_rscribe_resting_ecg_systemwelch_allyn_hscribe_holter_analysis_system_firmwareWelch Allyn R-Scribe Resting ECG SystemWelch Allyn H-Scribe Holter Analysis SystemWelch Allyn X-Scribe Cardiac Stress Testing SystemWelch Allyn Vision ExpressWelch Allyn Connex CardioWelch Allyn Diagnostic Cardiology SuiteWelch Allyn Q-Stress Cardiac Stress Testing System
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CWE ID-CWE-287
Improper Authentication
CVE-2025-3646
Matching Score-4
Assigner-VulnCheck
ShareView Details
Matching Score-4
Assigner-VulnCheck
CVSS Score-6.9||MEDIUM
EPSS-0.19% / 9.37%
||
7 Day CHG~0.00%
Published-03 Jan, 2026 | 23:33
Updated-20 Jul, 2026 | 23:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Petlibro Smart Pet Feeder Platform through 1.7.31 Authorization Bypass via Device Share API

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared owners to any device by exploiting missing permission checks. Attackers can send requests to the device share API to gain unauthorized access to devices and view owner information without proper authorization validation.

Action-Not Available
Vendor-petlibroPetlibrio
Product-petlibroSmart Pet Feeder Platform
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2025-3319
Matching Score-4
Assigner-IBM Corporation
ShareView Details
Matching Score-4
Assigner-IBM Corporation
CVSS Score-8.1||HIGH
EPSS-0.32% / 24.44%
||
7 Day CHG~0.00%
Published-20 Jun, 2025 | 14:50
Updated-24 Aug, 2025 | 11:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
IBM Spectrum Protect Server authentication bypass

IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access to unauthorized resources.

Action-Not Available
Vendor-IBM Corporation
Product-spectrum_protect_serverSpectrum Protect Server
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2025-31694
Matching Score-4
Assigner-Drupal.org
ShareView Details
Matching Score-4
Assigner-Drupal.org
CVSS Score-8.1||HIGH
EPSS-0.37% / 29.22%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:51
Updated-02 Sep, 2025 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

Action-Not Available
Vendor-two-factor_authentication_projectThe Drupal Association
Product-two-factor_authenticationTwo-factor Authentication (TFA)
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
  • Previous
  • 1
  • 2
  • 3
  • Next
Details not found