CVE-2026-119568

The record

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

Affected packages

Related vulnerabilities

• CVE-2026-66279 In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid… CWE-940
• CVE-2026-112408 Missing verification of source of a communication channel in the default_bucket()… CWE-940
• CVE-2026-101897 Angular is a development platform for building mobile and desktop web applications using… CWE-940
• CVE-2026-87705 Improper verification of source of a communication channel in Windows Hyper-V allows an… CWE-940
• CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin… CWE-940
• CVE-2026-85085 The Canva Android App before 2.376.0 allowed an external origin to be loaded in a… CWE-940
• CVE-2026-73419 NextAuth.js provides authentication for Next.js. CWE-940
• GHSA-g5qx-h5f3-mp2f TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable… CWE-940