CVE-2021-28122

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an unauthenticated user to use a crafted HTTP API request to create, read, update, or delete entries in the subscriber database. For example, new administrative users can be added. The issue occurs because Express is not set up to require authentication.

• CWE-306

• https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1Patch, Third Party Advisory
• https://github.com/open5gs/open5gs/issues/837Exploit, Third Party Advisory
• https://github.com/open5gs/open5gs/pull/838Patch, Third Party Advisory
• https://github.com/open5gs/open5gs/releasesRelease Notes, Third Party Advisory
• https://github.com/open5gs/open5gs/compare/v2.2.0...v2.2.1Patch, Third Party Advisory
• https://github.com/open5gs/open5gs/issues/837Exploit, Third Party Advisory
• https://github.com/open5gs/open5gs/pull/838Patch, Third Party Advisory
• https://github.com/open5gs/open5gs/releasesRelease Notes, Third Party Advisory

Published

Mar 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28114Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a na…5.4
• CVE-2021-28115The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS v…6.1
• CVE-2021-28116Squid through 4.14 and 5.x through 5.0.5, in some configurat…5.3
• CVE-2021-28117libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Disco…7.5
• CVE-2021-28119Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote…9.8
• CVE-2021-28121Virtual Robots.txt before 1.10 does not block HTML tags in t…9.8
• CVE-2021-28123Undocumented Default Cryptographic Key Vulnerability in Cohe…9.8
• CVE-2021-28124A man-in-the-middle vulnerability in Cohesity DataPlatform s…5.9
• CVE-2021-28125Apache Superset up to and including 1.0.1 allowed for the cr…6.1
• CVE-2021-28126index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) …6.1
• CVE-2021-28127An issue was discovered in Stormshield SNS through 4.2.1. A …7.5
• CVE-2021-28128In Strapi through 3.6.0, the admin panel allows the changing…8.1