CVE-2026-41020
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Oct 27, 2026
CISA due date
—
The record
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-104381 A missing authentication vulnerability in Fireware OS's FireCluster state synchronization… CWE-294
- CVE-2026-117470 Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn… CWE-294
- CVE-2026-116201 Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows… CWE-294
- CVE-2026-65824 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-294
- CVE-2026-114617 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-294
- CVE-2026-87952 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service… CWE-294
- CVE-2026-103314 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). CWE-294
- CVE-2026-73636 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation… CWE-294