CVE-2023-28126

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-305 CWE-362

Affected software

Vendor	Product	Versions
n/a	Avalanche	Avalanche versions 6.3.x and below

References

Timeline

Published: May 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-281277.5A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosu CVE-2023-281287.2An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t CVE-2023-281297.8DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatio CVE-2023-28136.1All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPr CVE-2023-281307.2Local user may lead to privilege escalation using Gaia Portal hostnames page.CVE-2023-281319.6A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that confi CVE-2023-281337.8Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file CVE-2023-281347.8Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker mus CVE-2023-28146.1A vulnerability classified as problematic has been found in SourceCodester Class Scheduling System 1.0. Affected is an unknown function of t CVE-2023-281407.0An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a mal CVE-2023-281416.3An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to a CVE-2023-281427.0A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers t