CVE-2026-24835

A flaw was found in Podman Desktop, where an authentication bypass vulnerability allows any malicious extension to completely circumvent permission checks. By exploiting a flaw where the `isAccessAllowed()` function unconditionally returns `true`, an attacker can gain unauthorized access to all authentication sessions. This enables malicious extensions to impersonate any user, hijack authentication sessions, and access sensitive resources without authorization.