CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- suitenumerique messagessuitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication5.3 Medium
- parse-community parse-serverParse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters9.3 Critical
- caddyserver caddyCaddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation8.1 High
workflownpm,@workflow/corenpm +1 moreVercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens5.3 Medium- rocket.chatRocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer8.0 High
- rocket.chatRocket.Chat: Users can login with any password via the EE ddp-streamer-service9.3 Critical
- natroteam natro macro, natromacro +1 moreNatro Macro: Malicious actions allowed through Discord RC Commands by any user6.4 Medium
- talisharTalishar: Authentication Bypass via Empty authKey Parameter Allows Unauthenticated Game Actions5.3 Medium
ec-cube/ec-cubePackagistEC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface6.7 Medium- olivetinOliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes8.8 High
- wwbn avideoWWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port8.1 High
- zitadelZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V28.2 High
- craftcms cms, craft cms +1 moreCraft has an unauthenticated activation email trigger with potential user enumeration6.9 Medium
- openclawOpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass7.5 High
- open-emr openemrOpenEMR has an Unauthenticated MedEx Token Disclosure10.0 Critical
openclawnpmOpenClaw has a Discord `allowFrom` slug-collision authorization bypass6.5 Medium- devolutions serverAuthentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions...9.8 Critical
- openclawOpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer8.5 High
- hackerbay oneuptimeOneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay8.2 High
- bytebaseBytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login9.3 Critical
- hewlett packard enterprise (hpe) hpe autopass license server (apls), hpe autopass license server +1 moreA remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS).10.0 Critical
- labredescefetrj wegiaWeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php9.8 Critical
- statamic cms, statamic +1 moreStatamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass8.8 High
- shoheitanaka japanized for woocommerceJapanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation5.3 Medium
- n8nn8n - Authentication Bypass in Chat Trigger Node6.3 Medium
- n8nn8n - SSO Enforcement Bypass via API6.0 Medium
- hoppscotchhoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover9.1 Critical
- discourseDiscourse doesn't ensure webhooks require a token6.5 Medium
- packistryPackistry accepts expired access tokens4.3 Medium
- No product listedImproper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows...8.2 High
- chia blockchainChia Blockchain RPC Server Master Passphrase get_private_key missing authentication2.0 Low
- cisco catalyst sd-wan manager, catalyst sd-wan controller and manager, sd-wan vbond orchestrator +1 more +3 moreCisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability10.0 Critical
- cisco catalyst sd-wan managerCisco Catayst SD-WAN Authentication Bypass Vulnerability9.8 Critical
- chia blockchainChia Blockchain RPC Credential rpc_server_base.py _authenticate improper authentication6.3 Medium
- gtsteffaniak filebrowser, filebrowser quantum +1 moreFileBrowser Quantum: Password Protection Not Enforced on Shared File Links7.1 High
- nvidia delegated license service, dls component of nvidia license system +1 moreNVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an...4.3 Medium
- datalinkdc dinkyDataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication6.9 Medium
- getsentry sentrySentry: Improper Authentication on SAML SSO process allows user identity linking9.1 Critical
- linuxfoundation strimzi kafka operator, red hat streams for apache kafka 2, streams for apache kafka 3 +1 more +3 moreStrimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication8.1 High
- lkw199711 smangaAn Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to...9.4 Critical
- significant-gravitas autogptAuthentication bypass in AutoGPT de Thesamur6.9 Medium
- opengamepanel ogp-websiteOGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a...10.0 Critical
- orthanc-server orthancOrthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's...4.7 Medium
- doruk communication and automation industry and trade inc. wispotterOTP Password Brute Forcing in DorukNet's Wispotter5.3 Medium
- deepen bajracharya video conferencing with zoomVideo Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation7.5 High
- microsoft windows admin centerWindows Admin Center Elevation of Privilege Vulnerability8.8 High
- openclawOpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching9.2 Critical
- openclawOpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin6.3 Medium
- openclaw, openclaw voice-call +1 moreOpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers8.2 High
- goauthentik authentikauthentik has a Signature Verification Bypass via SAML Assertion Wrapping8.8 High
- Show moreLoading…