CVE-2026-50741

Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method.

• CWE-94

• https://hackerone.com/reports/3780854Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/3781492Issue Tracking, Third Party Advisory

Published

Jun 26, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50736The pglogical queue mechanism, used to convey out-of-band co…9
• CVE-2026-50737When applying replicated changes for a row that is missing o…9
• CVE-2026-50738A use-after-free condition exists in pglogical's worker sign…7.7
• CVE-2026-50739A bypass for CVE‑2026‑34913 exists with proper ownership val…4.3
• CVE-2026-5074The ARMember Premium plugin for WordPress is vulnerable to S…6.5
• CVE-2026-50740A missing sanitisation vulnerability of user input in the zo…5.4
• CVE-2026-50742A stored XSS vulnerabilities exists in the `maintenance-acl-…5.4
• CVE-2026-50743A CSRF vulnerability exists in the `zone-include.php` script…5.4
• CVE-2026-50744A bypass to the admin‑only restriction of the XML‑RPC API in…4.3
• CVE-2026-50745A missing sanitisation vulnerability exists with user input …6.1
• CVE-2026-50746A malicious actor with access to the network could exploit a…10
• CVE-2026-50747A malicious actor with access to the network and low privile…9.9