CVE-2026-65400

An authentication issue was addressed with improved state management.

Critical Known exploited

Severity: 9.8 / 10; Critical · CVSS 3.1
Exploit chance (EPSS): 1.72%; Chance of exploitation in the next 30 days. Higher than 77.52% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Aug 18, 2026
Weakness: CWE-287 Improper Authentication
Fix: None yet; No fixed version published

Exploited in the wild. Apple macOS Improper Authentication Vulnerability (Apple macOS). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Aug 21, 2026.

Description

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it

Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

References

Advisories

Timeline

Aug 6, 2026 Published
Aug 18, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Aug 21, 2026 Remediation due for U.S. federal agencies
Oct 24, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials	Critical	Same weakness, CWE-287
GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user	Critical	Same weakness, CWE-287
GHSA-965c-763c-88jm better-auth: OAuth state can be used as a Magic Link to sign in as another user	Critical	Same weakness, CWE-287
GO-2026-6773 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)	High	Same weakness, CWE-287
GO-2026-6786 Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover	High	Same weakness, CWE-287
GHSA-xv7q-fvmc-jx96 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover	High	Same weakness, CWE-287
GHSA-68w4-83fh-f2w8 pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password	High	Same weakness, CWE-287
GHSA-r44w-v6gf-x3p6 pyLoad has an authentication bypass in API key validation (check_apikey cache)	High	Same weakness, CWE-287

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor