Authentication & access control in AI-generated code

1. Claude-assisted browser gateway used an unanchored pattern to validate Chrome extension origins, so a crafted page could open the debugging WebSocket from any domain.

   CVE-2026-55536Aug 25, 2026mervinpraison/praisonaiPythonClaudeDirect introductionAuthentication & access control

2. AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.

   CVE-2026-79665Aug 25, 2026lin-snow/ech0GoCursorFlawed AI-written codeAuthentication & access control

3. PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.

   HighCVE-2026-55538Aug 25, 2026mervinpraison/praisonaiPythonUnidentified AI toolFlawed AI-written codeAuthentication & access control

4. A CLI coding assistant co-authored the commit that added the transaction API, and its single-transaction endpoint fetched any record by primary key without company scoping or a permission check.

   CVE-2026-77759Aug 21, 2026roskus/prospero-flow-crmPHPClaudeDirect introductionAuthentication & access control

5. A coding assistant co-authored the commit that added follows and notifications to this Python web app, and the four new endpoints that change that state were exposed as plain GET routes, so any page could trigger them for a signed-in user.

   CVE-2026-73162Aug 11, 2026misp/cti-transmutePythonClaudeDirect introductionAuthentication & access control

6. With the optional DeepStream stack installed, request-level video settings can activate GPU decoding without startup authorization and omit the normal metadata pixel check.

   CVE-2026-78684Aug 11, 2026vllm-project/vllmPythonClaudeDirect introductionAuthentication & access control

7. A coding assistant co-authored the commit that added emoji reactions to the comment system of this Python web app, and the new reaction endpoint never checked whether the caller was allowed to see the comment it changed.

   CVE-2026-73155Aug 11, 2026misp/cti-transmutePythonClaudeDirect introductionAuthentication & access control

8. AI-generated code placed PermissionSaveController under only authentication, omitting authorization checks, letting any authenticated user grant all permissions to any role.

   HighCVE-2026-59233Aug 10, 2026roskus/prospero-flow-crmPHPClaudeIncomplete remediationAuthentication & access control

9. A coding assistant co-authored the commit that added the following list to this Python web app, and the entries it returns include the email address of every account the signed-in user follows.

   CVE-2026-72760Aug 10, 2026misp/cti-transmutePythonClaudeDirect introductionAuthentication & access control

10. AI-written gateway proxy stored user-supplied API base URLs without scheme or host checks and fetched them server-side, letting authenticated users reach internal services.

    CVE-2026-71211Aug 5, 2026mlflow/mlflowTypeScriptClaudeDirect introductionAuthentication & access control

11. With native tools enabled, a signed-in Open WebUI user who knew another user's file ID could read indexed content through request-local model knowledge. The AI-assisted change removed the query's owner check. The repair filters supplied files using the authenticated user's access.

    MediumCVE-2026-70487Aug 2, 2026open-webui/open-webuiPythonUnidentified AI toolFlawed AI-written codeAuthentication & access control

12. AI-written code implemented a six-capability denylist omitting SYS_TIME, letting tenants add it and bypass PodSpec safety validation.

    HighCVE-2026-50570Jul 28, 2026fission/fissionGoClaudeIncomplete remediationAuthentication & access control

13. Claude-coauthored local-trust code omitted Host validation, so DNS rebinding could give an attacker admin context and arbitrary command execution.

    CriticalCVE-2026-77087Jul 22, 2026paperclipai/paperclipTypeScriptClaudeDirect introductionAuthentication & access control

14. An AI-assisted pull request, marked [AI] per the repository's convention, tried to harden device.pair.approve by adding an approve-side role check, but applied it only to device-token callers, leaving the pre-existing flaw for other sessions.

    CVE-2026-62218Jul 17, 2026openclaw/openclawTypeScriptChatGPT/CodexFlawed AI-written codeAuthentication & access control

15. A Claude-assisted change added order API handlers that fetched records by ID without checking the caller's company, so users of one company could read or change another company's orders.

    CVE-2026-59237Jul 16, 2026roskus/prospero-flow-crmPHPClaudeDirect introductionAuthentication & access control

16. The native DI OAuth token writer stored credentials with umask-dependent permissions. Version 0.3.5 repairs successful owner-controlled writes; untouched older stores still require rewriting or manual restriction.

    HighCVE-2026-54447Jul 15, 2026cyberjunky/python-garminconnectPythonClaudeDirect introductionAuthentication & access control

17. A change generated with Claude Code introduced the workflow version backup tool and its storage without tenant scoping, leaving default-scope backups reachable by any authenticated tenant in multi-tenant mode.

    MediumCVE-2026-55608Jul 14, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionAuthentication & access control

18. AI-written multi-tenant workflow version endpoints used workflowId/versionId without instance scope checks, letting attackers access or delete other tenants' workflow versions and node credentials.

    CVE-2026-54052Jul 14, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionAuthentication & access control

19. The AI-attributed change, written with OpenAI GPT-5 via Codex desktop, introduced terminal handlers that spawn and drive an interactive shell without a separate authentication gate.

    CriticalCVE-2026-58123Jul 10, 2026nesquena/hermes-webuiPythonChatGPT/CodexDirect introductionAuthentication & access control

20. Code co-written with Claude Opus 4.6 (1M context) introduced the flaw by first adding the settings routes that ha-mcp exposes without authentication at the bare root for Home Assistant ingress.

    MediumGHSA-Q855-8RH5-JFGQJul 7, 2026homeassistant-ai/ha-mcpPythonClaudeDirect introductionAuthentication & access control

21. An AI-assisted trusted-proxy exception let fresh, unapproved Control UI devices retain client-requested scopes before server-side pairing approved them. The original device-less path cleared scopes and must be distinguished from the fresh-device path. Trusted-proxy authentication alone did not establish device privilege. An initial clamp removed unapproved scopes, a later change reintroduced the exception, and a subsequent pairing repair closed that recurrence. Source and published package provenance support discontinuous affected windows, without certifying every historical package or attributing the recurrence to AI.

    GHSA-QJPC-QF9M-XWMRJul 2, 2026openclaw/openclawTypeScriptCursorDirect introductionAuthentication & access control

22. The Claude Code-attributed change introduced the unauthenticated MCP bridge that forwarded tool calls to enabled backends, including tools in the default-on devtools group.

    CriticalCVE-2026-59726Jul 1, 2026ruvnet/rufloTypeScriptclaude-flowDirect introductionAuthentication & access control

23. An agent-built session import path skipped profile stamping when constructing sessions, so imports landed outside the caller's active profile and bypassed its workspace boundary.

    CVE-2026-58174Jun 30, 2026nesquena/hermes-webuiPythonClaudeDirect introductionAuthentication & access control

24. AI-written contact tracking trusted a caller-controlled channel type when deciding whether a conversation was authorized, allowing remote access under complex conditions.

    LowCVE-2026-13591Jun 29, 2026deepmyst/mystiTypeScriptClaudeDirect introductionAuthentication & access control

25. A change written by Claude Code added the experiment-scoped label-schema REST routes without registering their basic-auth validators, introducing the missing-authorization flaw.

    CVE-2026-13484Jun 28, 2026mlflow/mlflowTypeScriptClaudeDirect introductionAuthentication & access control

26. The AI-written OAuth layer required only read scope on /mcp and dispatched store_memory/delete_memory without per-tool write checks. A read-only OAuth token could thus mutate memories, despite the read-only grant.

    CVE-2026-49291Jun 26, 2026doobidoo/mcp-memory-servicePythonClaudeDirect introductionAuthentication & access control

27. The missing owner checks already existed in human-written code; a commit co-authored by Cursor tried to harden project deletion with a guard keyed on lead_id, a field members could still rewrite to delete owner projects.

    CVE-2026-61442Jun 25, 2026mervinpraison/praisonaiPythonCursorFlawed AI-written codeAuthentication & access control

28. Copilot-assisted sandbox code silently fell back to a plain subprocess when Landlock was unavailable, letting untrusted code bypass the configured filesystem and network restrictions.

    CVE-2026-57144Jun 18, 2026mervinpraison/praisonaiPythonGitHub CopilotFlawed AI-written codeAuthentication & access control

29. A change generated with Claude Code introduced the vulnerable behavior: when LINEAR_WEBHOOK_SECRET is unset, LinearBot skips Linear-Signature verification, so a forged webhook event can run the configured agent.

    CVE-2026-56837Jun 18, 2026mervinpraison/praisonaiPythonGitHub CopilotDirect introductionAuthentication & access control

30. Vitest's AI-written code exposed an ungated CDP API, letting clients bypass disabled write/exec restrictions to achieve remote code execution.

    CriticalCVE-2026-53633Jun 15, 2026vitest-dev/vitestJavaScriptChatGPT/CodexIncomplete remediationAuthentication & access control

31. PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.

    HighCVE-2026-55534Jun 13, 2026mervinpraison/praisonaiPythonUnidentified AI toolFlawed AI-written codeAuthentication & access control

32. AI-written code allowed site admins to access org-only galaxy data by incorrectly applying org conditions, exposing restricted distribution data.

    CVE-2026-54362Jun 12, 2026misp/mispPHPClaudeDirect introductionAuthentication & access control

33. An AI-assisted change let the ordinary settings request install the first password of a passwordless Hermes WebUI, so a remote caller who reached the port during first run could choose the owner credential and lock the operator out.

    CVE-2026-49973Jun 11, 2026nesquena/hermes-webuiPythonClaudeDirect introductionAuthentication & access control

34. A Claude-assisted change let a signed-in user run automations against any contact ID through a service-role client, so one tenant could modify another tenant's contacts; a later partial fix still leaves paused runs unchecked.

    CVE-2026-49141Jun 8, 2026arnasdon/wacrmTypeScriptClaudeDirect introductionAuthentication & access control

35. AI-written importer code checked template existence but omitted organization ownership validation, letting any user overwrite another organization’s event template.

    MediumCVE-2026-10855Jun 4, 2026misp/mispPHPClaudeDirect introductionAuthentication & access control

36. AI-written code returned raw MCP server configs with unredacted secrets to non-owner users, exposing provider credentials.

    CVE-2026-44653Jun 2, 2026danny-avila/librechatTypeScriptGitHub CopilotFlawed AI-written codeAuthentication & access control

37. The AI-assisted change that added permission checks to the gateway routes registered validators for every gateway operation but the three list routes, so any signed-in user could keep enumerating all gateway secrets, endpoints and model definitions. The repair filters those list responses down to the rows the caller is allowed to read.

    CVE-2026-3198Jun 2, 2026mlflow/mlflowPythonClaudeFlawed AI-written codeAuthentication & access control

38. Claude-coauthored code created an embedded control server with no authentication. Anyone who could reach it could invoke non-health command routes.

    CVE-2026-10281Jun 1, 2026enderfga/claw-orchestratorTypeScriptClaudeDirect introductionAuthentication & access control

39. AI-written verify_token() returned early when CALL_SERVER_TOKEN was unset, letting unauthenticated callers list, read, invoke, and unregister agents on the public server.

    CVE-2026-47396May 29, 2026mervinpraison/praisonaiPythonCursorDirect introductionAuthentication & access control

40. AI-assisted work added an assistant service to the MLflow tracking server and mounted it under the /ajax-api/ prefix, where the server's cross-origin request blocking did not apply, so a web page could rewrite its configuration and reach command execution.

    CVE-2026-2611May 19, 2026mlflow/mlflowPythonClaudeDirect introductionAuthentication & access control

41. AI-written code allowed missing tenant headers to silently fall back to process-level n8n credentials, risking cross-tenant data exposure.

    CVE-2026-45707May 18, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionAuthentication & access control

42. A change co-authored by Claude Opus 4.6 (1M context) introduced the backup feature that wrote pre-edit YAML copies into a yaml_backups folder inside Home Assistant's web-served www directory, exposing them to unauthenticated download.

    MediumGHSA-G39V-CVJH-8FPFMay 14, 2026homeassistant-ai/ha-mcpPythonClaudeDirect introductionAuthentication & access control

43. The initial import of the project, which its requirements document says was developed with Claude Code, introduced a Dockerfile without a USER directive, so the images built from it ran as root until the fix.

    LowCVE-2026-44218May 5, 2026jo-jo98/ciguardPythonClaudeDirect introductionAuthentication & access control

44. AI-written code logged sensitive MCP tool-call arguments on authenticated HTTP requests, exposing secrets to anyone with log access.

    CVE-2026-42282Apr 25, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionAuthentication & access control

45. Claude Code wrote the pre-authentication logging of request headers and JSON-RPC bodies in the POST handler, which introduced the vulnerability.

    CVE-2026-41495Apr 23, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionAuthentication & access control

46. The AI-written server used Access-Control-Allow-Origin: * with auth off by default, letting any browser tab exfiltrate the graph via GET /query and persistently poison nodes via POST /learn.

    GHSA-2R2P-4CGF-HV7HApr 22, 2026nickcirv/engramTypeScriptClaudeDirect introductionAuthentication & access control

47. AI-written code returned early on an auto-allow sandbox result, skipping path-constraint checks and letting path traversal commands read outside the sandbox.

    CVE-2026-35570Apr 21, 2026gitlawb/openclaudeTypeScriptChatGPT/CodexDirect introductionAuthentication & access control

48. A change co-authored by Claude Opus 4.6, in a pull request generated with Claude Code, introduced the vulnerable behavior: _reload_dotenv loads each profile's .env into os.environ without removing the previous profile's keys.

    CVE-2026-6830Apr 21, 2026nesquena/hermes-webuiPythonClaudeDirect introductionAuthentication & access control

49. The AI-written code treated any empty Team ID as Apple-sentinel, letting ad-hoc signed processes with allowlisted Signing IDs bypass FAA path protections.

    CVE-2026-40599Apr 21, 2026craigjbass/clearancekitSwiftClaudeDirect introductionAuthentication & access control

50. List, create, and revoke operations on agent keys are gated only on having a board role, with no check that the caller belongs to the company owning the agent, exposing a cross-tenant object-reference flaw.

    GHSA-3XX2-MQJM-HG9XApr 16, 2026paperclipai/paperclipTypeScriptClaudeNew attack surfaceAuthentication & access control

Search all 86 findings in the index →