CVE-2026-90481
Quick assessment
Affected
PortSwigger Burp Suite DAST
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 PortSwigger Burp Suite DAST（原 Burp Suite Enterprise Edition）2026.8 版本之前，存在一种通过替代路径或通道绕过身份验证的漏洞。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PortSwigger | Burp Suite DAST | 2021.11< 2026.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90481
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PortSwigger | Burp Suite DAST | 2021.11 ~ 2026.8 | - |
|
II. Public POCs for CVE-2026-90481
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90481
请登录查看更多情报信息。
Vendor Pages for CVE-2026-90481 (1)
IV. Related Vulnerabilities
Same weakness: CWE-288
-
CVE-2026-63493
Snipe-IT: 2FA bypass via the API token flow -
CVE-2026-79680
Authentication bypass vulnerability in the password authenti -
CVE-2026-93928
WordPress Taxi Booking Manager for WooCommerce plugin < 2.0. -
CVE-2026-58269
Sync-in Server has a complete 2FA Bypass via `POST /api/auth -
CVE-2026-81868
Steeltoe: Header-forwarded client cert lacks proof of privat
V. Comments for CVE-2026-90481
No comments yet