CVE-2026-55366

CriticalCVSS 9.8/10Last modified Sep 21, 2026

Description

In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Google	Android	Android kernel

References

https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01Vendor Advisory

Timeline

Published: Sep 15, 2026
Last modified: Sep 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-553677.5h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could CVE-2026-553688.1h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-l CVE-2026-553696.5Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the CVE-2026-55376.3A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the f CVE-2026-553706.4Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a su CVE-2026-553716.9OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion pictur CVE-2026-553736.2OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions pri CVE-2026-553744.8canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values ret CVE-2026-553755.3canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_CVE-2026-553768.8Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user CVE-2026-553778.1Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted an CVE-2026-553789.3JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflow