CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- openbmb internet of agents OpenBMB Internet of Agents Agent Registry app.py register missing authentication 6.9 Medium
- naimurrahmannahid naimur email otp verification for woocommerce Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization 9.8 Critical
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter 9.1 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 6.4 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.2 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.1 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 6.5 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.8 Critical
- sph engineering ugcs UgCS server HCI authentication bypass with empty credentials 9.3 Critical
- bubka 2fauth 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification 9.8 Critical
- bubka 2fauth 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value 9.8 Critical
- freescout-help-desk freescout FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets 5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 more Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: admin api missing audience check 6.8 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding 4.2 Medium
- unknown wurdey Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass 9.8 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 more Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 High
- red hat build of keycloak 26.4.17, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 High
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 more Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession 7.4 High
- openbmb internet of agents OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authentication 6.9 Medium
- agentscope-ai agentscope agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authentication 6.9 Medium
- openhands OpenHands Landing missing authentication 5.3 Medium
- gpustack GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin 9.8 Critical
- linksys e5350 Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication 10.0 Critical
- yezhihao jt808-server yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication 6.9 Medium
- watchguard authpoint authentication gateway WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service 9.2 Critical
- linksys e5600 Linksys E5600 Login mesh_login.cgi improper authentication 10.0 Critical
- No product listed On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is... 9.8 Critical
- No product listed Umami 2FA Policy route.ts single-factor authentication 5.3 Medium
- smub easy digital downloads – ecommerce payments and subscriptions made easy Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture 8.1 High
- surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover 8.1 High
- google android A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger... 6.1 Medium
- absolute security secure access Authentication bypass in Secure Access Servers 9.3 Critical
- private internet access firefox extension CVE-2026-120627 7.5 High
- bufanyun hotgo HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code 9.2 Critical
- wavlink wn536ax6-a WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication 6.9 Medium
- gitea Gitea OAuth2 account auto-linking takeover through the sign-up form 9.8 Critical
- presenton Presenton API missing authentication 6.9 Medium
- roxnor wp social login and register social counter Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback 8.1 High
- uncanny owl toolkit for learndash, uncannyowl uncanny toolkit for learndash +1 more Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter 9.8 Critical
- nanbu welcart e-commerce Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter 5.3 Medium
- stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash 6.5 Medium
- unknown security optimizer Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting 7.5 High
- roostorg coop Coop has SAML cross-tenant authentication bypass 7.4 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 more pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username 8.9 High
- socfortress copilot SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression) 7.5 High
- givanz vvveb Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover 9.8 Critical
- traefik Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider 7.0 High
- unknown security plugin, firewall & malware scanner with auto removal Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code 7.5 High
- Show olderLoading…