CVE-2026-20152

The record

A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass authentication policy requirements. This vulnerability is due to improper validation of user-supplied authentication input in HTTP requests. An attacker could exploit this vulnerability by sending HTTP requests that contain specific authentication requests to an affected device. A successful exploit could allow the attacker to bypass policy enforcement on the device. There is no direct impact to the Cisco Secure Web Appliance. However, as a result of exploiting this vulnerability, an attacker could send HTTP requests that should be restricted through the device.

Affected packages

Related vulnerabilities

• CVE-2026-88837 BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic… CWE-305
• CVE-2026-86207 An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in… CWE-305
• CVE-2026-16895 A logic vulnerability (fail-open condition) has been identified within the Metasploit… CWE-305
• CVE-2026-78619 Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code… CWE-305
• CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from… CWE-305
• CVE-2026-1621 Authentication bypass by primary weakness vulnerability in Universal Software Inc. CWE-305
• CVE-2026-65935 Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by… CWE-305
• CVE-2026-19292 Re-pairing with a legitimate device can use a lower security level than previous making… CWE-305