GHSA-5cvp-p7p4-mcx9
NoneCVSS
—
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | neotoma | 0.6.0 | 0.11.1 |
Related vulnerabilities
- CVE-2026-45577 Neotoma provides versioned records that persist across agent runs. Same vulnerability
- CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
- CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
- CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288
- CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email… CWE-288
- CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in… CWE-288
- CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an… CWE-288
- CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. CWE-288