By weakness (CWE)

CWE-841: related vulnerabilities

CVEs classified under CWE-841. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-48505HIGH 7.4

  Filament, a Laravel development toolkit, contains a flaw in its app-based multi-factor authentication (MFA) recovery code system that allows a single recovery code to be used multiple times if an attacker submits it rapidly in parallel. Normally, recovery codes are single-use—meant to be burned after one authentication attempt. An attacker who has stolen both a user's password and recovery codes could exploit this concurrency issue to create multiple authenticated sessions from a single code, significantly extending their unauthorized access window. This only affects app-based MFA with recovery codes enabled; email-based MFA is not vulnerable. Versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 are affected.

• CVE-2026-46540MEDIUM 6.5

  Nimiq's light client implementation contains a state synchronization bug where certain blockchain reorganizations (forks) fail to properly update critical consensus state. When a light client switches to a fork chain that ends in a macro block—a special checkpoint or validator election block—it updates its main chain pointer but forgets to update related state variables that track the most recent macro block and active validators. This causes the light client to verify subsequent blocks against outdated information, either rejecting valid blocks or stalling entirely if an election block triggered the fork. The bug only affects light clients (thin clients), not full nodes, and is fixed in version 1.4.0.

• CVE-2026-45023MEDIUM 5.4

  AutoGPT versions before 0.6.59 contain a flaw in their API implementation that allows authenticated users to execute workflow blocks without consuming credits from their account balance. The vulnerability stems from an API endpoint that bypasses the credit-checking logic present elsewhere in the system, enabling users to run unlimited blocks at no cost. This is a business model violation rather than a critical system compromise, but it undermines the platform's monetization and resource management controls.

• CVE-2025-36333MEDIUM 4.3

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a flaw that allows authenticated users to bypass intended workflow restrictions and perform actions they should not be permitted to execute. An attacker with valid credentials could exploit this to make unauthorized changes within the platform, though the vulnerability does not enable data theft or system unavailability. The issue stems from inadequate enforcement of behavioral workflow controls during user action validation.