NVD disclosure day

Published threat advisories for October 25, 2026

CVE-2026-116199

Snipe-IT Authentication Bypass via Google SSO Callback

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A vulnerability in Snipe-IT's Google Single Sign-On (SSO) could allow deactivated users to regain access with original permissions. This occurs if a user's username matches their Google account email and they use Google SSO, potentially granting administrative access. Organizations using Snipe-IT with Google SSO should

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-116163

Parse Server Authentication Bypass via AuthAdapter Subclassing.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

Parse Server has a critical vulnerability allowing authentication bypass. Attackers can exploit this by supplying arbitrary data to sign up, link identities, or log in as existing users if custom authentication adapters are not properly called. This could lead to unauthorized access to user accounts and services. Parse

NVD modified: NVD date unavailable