CVE-2026-11374

The record

In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.

Affected packages

Related vulnerabilities

• CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
• CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
• CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287
• CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-287
• CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40… CWE-287
• CVE-2026-14563 The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the… CWE-287
• CVE-2026-14559 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's… CWE-287
• CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints… CWE-287