$ filter --tag auth-bypass

CVE-2026-35616: FortiClient EMS Reverse-Proxy Header Spoofing Auth Bypass

A deep dive into CVE-2026-35616 — the FortiClient EMS authentication bypass. The Django CertChainAuth middleware blindly trusts the X-SSL-CLIENT-VERIFY HTTP header, so any unauthenticated client can spoof a verified-client-certificate state and walk straight past the auth gate. Full root-cause analysis, a 401→500 detection oracle, an unauthenticated 225 KB data-disclosure endpoint, a read-only enumeration PoC, and remediation.

2026-05-13

CVE-2025-54309: CrushFTP AS2 Auth Bypass to Unauthenticated RCE

A full breakdown of CVE-2025-54309 — the CrushFTP zero-day exploited in the wild in July 2025. A logic flaw in loginCheckHeaderAuth() lets a crafted AS2-To header skip authentication entirely, after which an attacker creates an admin account, remaps the Virtual File System to the OS root, drops a malicious Java plugin and reaches remote command execution. Root cause, the bypass-to-RCE kill chain, detection IOCs and remediation.

2025-08-02