CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- tarkov data manager, the-hideout tarkov-data-manager +1 moreTarkov Data Manager Authentication Bypass vulnerability9.8 Critical
- wolfsshAuthentication Bypass9.4 Critical
- curllibssh key passphrase bypass without agent set3.1 Low
- convoypanel panelPterodactyl TOTPs can be reused during validity window6.5 Medium
- blueaccesstech cobalt x1Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows...9.8 Critical
- coollabs coolifyCoolify has a Privilege Escalation - low privileged users can see and use admin invitation links7.7 High
- ubiquiti inc unifi protect application, ui unifi protect +1 moreA malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi...8.8 High
- code-projects online product reservation systemcode-projects Online Product Reservation System Administration Backend improper authentication6.9 Medium
- 1234n minicmsbg5sbk MiniCMS Article post-edit.php improper authentication6.9 Medium
- 1234n minicmsbg5sbk MiniCMS Trash File Restore post.php improper authentication6.9 Medium
- 1234n minicmsbg5sbk MiniCMS Publish page-edit.php improper authentication6.9 Medium
- 1234n minicmsbg5sbk MiniCMS File Recovery Request page.php delete_page improper authentication6.9 Medium
- revotech i6032w-fhw firmwareAn authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 -...7.5 High
- rustfsRustFS has a gRPC Hardcoded Token Authentication Bypass9.8 Critical
- zeroheightAn issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API...6.5 Medium
- gmission web faxPrivilege Escalation in Gmission Web FAX8.4 High
- pangolinAn issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate...9.8 Critical
- joey-zhou xiaozhi-esp32-server-javajoey-zhou xiaozhi-esp32-server-java Cookie AuthenticationInterceptor.java tryAuthenticateWithCookies improper authentication5.3 Medium
- simsimstudioai sim CRON Secret internal.ts improper authentication6.9 Medium
- alteryx serverAlteryx Server status improper authentication6.9 Medium
- tyche softwares product delivery date for woocommerce – liteWordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.0 - Broken Access Control vulnerability5.3 Medium
- hikvision ds-7104hghi-f1, ds-7104hghi-f1 firmware, ds-7204hghi-f1 +1 more +3 moreThere is an improper authentication vulnerability in some Hikvision DVR products. Due to the...6.5 Medium
- jeecg bootJeecgBoot Multi-Tenant Management SysTenantController.java improper authentication5.3 Medium
- google cloud dialogflow cx messengerAuthentication Bypass in Dialogflow CX Messenger6.9 Medium
- tp-link systems inc. wa850re, tp-link tl-wa850re firmware +1 moreConfiguration Disclosure Vulnerability in TP-Link WA850RE5.7 Medium
- radiometer medical aps abl800 basic and abl800 flex analyzers, abl90 flex and abl90 flex plus analyzers, aqt90 flex analyzers +2 moreRemote Code Execution Vulnerability in Radiometer Products7.2 High
- drivelockAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through...9.8 Critical
- whyun wpcom memberWPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP8.1 High
- ningyuanda tc155, shenzhenningyuandatechnology tc155 firmware +1 moreNingyuanda TC155 RTSP Live Video Stream Endpoint improper authentication5.3 Medium
- elastic elasticsearchElasticsearch Improper Authentication6.8 Medium
- shiguangwu sgwbox n3, sgwbox n3 firmware +1 moreShiguangwu sgwbox N3 POST Message fsnotify improper authentication6.9 Medium
- wekan project wekanAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed...8.2 High
- allauthdjango-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions5.4 Medium
- haxxorsid stock-management-systemhaxxorsid Stock-Management-System employees missing authentication6.9 Medium
- sparkle wp construction lightConstruction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation4.3 Medium
- sangoma freepbx, flarum framework +1 moreFreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header9.3 Critical
- filamentphp filamentFilament's multi-factor authentication (app) recovery codes can be used multiple times8.1 High
- nextcloud approval, kiteworks security-advisories +1 moreNextcloud Approval app allows users to request approval for other users file2.7 Low
- pickplugins user verification by pickpluginsEmail Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account Takeover9.8 Critical
- smallstep step-caStep CA Has Authorization Bypass in ACME and SCEP Provisioners10.0 Critical
- fanvil x210 firmwareAn issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local...9.8 Critical
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 moreEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow an...4.6 Medium
- salt project saltSalt Master authentication protocol downgrade may enable minion impersonation7.5 High
- mattermost, mattermost server +1 moreAccount Takeover via Code Exchange Endpoint9.9 Critical
- mattermost, mattermost server +1 moreAccount takeover on OAuth/OpenID-enabled servers9.9 Critical
- better-authbetter-auth before 1.4.0 Session Revocation via Forged Cookie2.0 Low
- factionsecurity factionFACTION Unauthenticated Custom Extension Upload leads to RCE9.7 Critical
- lunary, lunary-ai lunary-ai/lunary +1 moreImproper Authentication in lunary-ai/lunary9.3 Critical
- itel idenc firmwareThe Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper...10.0 Critical
- newtec celoxa504 firmware, celoxa820 firmware +1 moreThe Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is...9.8 Critical
- Show moreLoading…