CWE-1390: Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- sonatype nexus repository 3 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again 9.1 Critical
- hamid alinia login with phone number WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability 8.8 High
- acronis cyber protect 17, cyber protect cloud agent +1 more Local privilege escalation due to improper authentication. The following products are affected:... 7.1 High
- creditnirvana collections platform (collectionworkz) Improper Authentication Vulnerability in CreditNirvana Collections Platform 9.3 Critical
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +8 more +10 more Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability 8.1 High
- microsoft azure-keyvault-administration, azure-keyvault-certificates, azure-keyvault-keys +5 more +7 more Azure Key Vault Security Feature Bypass Vulnerability 7.4 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 more Windows Error Reporting Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 r2 +11 more +13 more Active Directory Federation Services (AD FS) Spoofing Vulnerability 7.4 High
- microsoft windows server 2019, windows server 2019 (server core installation), windows server 2022 +2 more +4 more Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability 5.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 r2 +11 more +13 more Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability 5.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 more Windows Kernel Security Feature Bypass Vulnerability 5.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2016 +8 more +10 more Active Directory Federation Services (AD FS) Spoofing Vulnerability 8.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 more Windows Print Spooler Components Elevation of Privilege Vulnerability 7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 more Windows Projected File System Elevation of Privilege Vulnerability 7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Network Device Enrollment Service (NDES) Spoofing Vulnerability 6.8 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +9 more +11 more Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability 7.8 High
- microsoft powertoys Microsoft PowerToys Tampering Vulnerability 5.5 Medium
- microsoft windows 10 version 1809, windows server 2019, windows server 2019 (server core installation) +1 more +3 more Windows Modern Device Management (MDM) Tampering Vulnerability 5.5 Medium
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 more Microsoft Exchange Server Elevation of Privilege Vulnerability 8.8 High
- berriai litellm LiteLLM Weak JWT Authentication via Email-Based User Lookup 7.6 High
-
lemonldap-ngDebian Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify… 9.1 Critical -
lemonldap-ngDebian Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not ve… 9.1 Critical - gitroomhq postiz-app Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key 7.1 High
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 more SQL Server Elevation of Privilege Vulnerability 8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Windows iSCSI Security Feature Bypass Vulnerability 9.8 Critical
- microsoft azure arc sql server extension, azure arc sql server extension +1 more Azure Arc SQL Server Extension Elevation of Privilege Vulnerability 8.8 High
- ebyte na111-m firmware Ebyte NA111-M Weak Authentication 9.3 Critical
- nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an... 8.1 High
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 more Mira Hormone Monitor, Mira Android App Weak Authentication 9.3 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Microsoft Windows Search Component Information Disclosure Vulnerability 5.5 Medium
- ziina WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability 7.5 High
- No product listed An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive... 7.5 High
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 more Microsoft SharePoint Server Security Feature Bypass Vulnerability 9.1 Critical
- rockwell automation factorytalk® services platform Rockwell Automation FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation Bypass 8.8 High
- villatheme ald – dropshipping and fulfillment for aliexpress and woocommerce WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication vulnerability 4.8 Medium
- palo alto networks cortex xsiam commvaultsecurityiq marketplace, cortex xsoar commvaultsecurityiq marketplace +1 more Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration 8.1 High
- dts electronics industry and trade ltd. co. redline wr3200 Authentication Bypass in DTS Electronics' Redline WR3200 9.8 Critical
- doorkeeper-gem doorkeeper-openid connect Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret 6.3 Medium
- sangoma freepbx, freepbx security-reporting +1 more FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module 7.6 High
- indian motorcycle scout bobber + tech Indian Scout Bobber 2025 WCM-to-ECM weak authentication 4.1 Medium
- indian motorcycle scout bobber + tech Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange 4.1 Medium
- avideo AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint 9.2 Critical
- microsoft dynamics 365 business central, dynamics 365 business central 2024 release wave 2, dynamics 365 business central 2026 release wave 1 +2 more +4 more Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability 7.8 High
- sonicwall sonicos A vulnerability in the access control mechanism of SonicOS may allow certain management interface... 8.0 High
- borg technology corporation spm 2007 BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass 9.3 Critical
- No product listed Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication... 7.3 High
- devolutions server Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server... 8.2 High
- devolutions server Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and... 8.2 High
- pickplugins user verification WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerability 5.3 Medium
- Show olderLoading…