CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- linuxcontainers incusLocal Incus UI web server vulnerable to nuthentication bypass8.8 High
- openclawOpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway5.1 Medium
- kalcaddle kodboxkalcaddle kodbox Password-protected Share auth.class.php can improper authentication6.3 Medium
- n8nn8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover8.8 High
- linuxfoundation nats-serverNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching4.2 Medium
- linuxfoundation nats-serverNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers6.4 Medium
- linuxfoundation nats-serverNATS is vulnerable to MQTT hijacking via Client ID6.5 Medium
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion8.1 High
- newapi new api, quantumnous new-api +1 moreNew API has passkey-based secure step-up verification bypass for root-only channel secret disclosure4.9 Medium
- wwbn avideoAVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php9.4 Critical
- kalcaddle kodboxkalcaddle kodbox Password Login index.class.php tfaVerify improper authentication6.3 Medium
hybridauth/hybridauthPackagistHybridAuth SSL Curl.php certificate validation6.3 Medium- shenzhen hcc technology mpos m6 plusShenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay2.3 Low
- shenzhen hcc technology mpos m6 plusShenzhen HCC Technology MPOS M6 PLUS Bluetooth missing authentication2.3 Low
- No product listedMacCMS Timming API Endpoint Timming.php weak authentication6.9 Medium
- omnipemf neorhythmOmniPEMF NeoRhythm BLE missing authentication2.3 Low
- wwbn avideoAVideo has an unauthenticated decrypt oracle leaking any ciphertext7.5 High
- go-vikunja vikunjaVikunja has TOTP Reuse During Validity Window5.7 Medium
- traefik, red hat openshift dev spaces 3.27, openshift dev spaces 3.28 +1 more +3 moreTraefik mTLS bypass via fragmented ClientHello SNI extraction failure7.8 High
- blakeblackshear frigateFrigate has insecure password change functionality8.6 High
- yi technology home cameraYi Technology YI Home Camera CGI Endpoint ipc missing authentication5.3 Medium
- parse-community parse-serverParse Server: Auth provider validation bypass on login via partial authData7.0 High
- minioMinIO: JWT Algorithm Confusion in OIDC Authentication9.2 Critical
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: Improper Authentication and Origin Validation Error6.5 Medium
- smallstep certificates, step-ca +1 moreStep CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)10.0 Critical
- secomea gatemanagerUnauthorized access to information6.5 Medium
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware8.1 High
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token7.3 High
- glpi-project glpiGLPI has a MFA bypass6.5 Medium
- duende identityserver4Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication6.3 Medium
- parse-community parse-serverParse Server affected by empty authData bypassing credential requirement on signup6.9 Medium
- b3log siyuanSiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure5.3 Medium
- tenda ac8, ac8 firmware +1 moreTenda AC8 IPv6 check_is_ipv6 ip address for authentication9.3 Critical
- samsung smart switchImproper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to...6.9 Medium
- tiandy easy7 integrated management platformTiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authentication6.9 Medium
- steveiliop56 tinyauthTinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint8.5 High
- adguard adguardhomeAdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass9.8 Critical
- neo4j enterprise edition, neo4j +1 moreAuth misconfiguration when multiple providers enabled2.1 Low
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthentication Bypass in Web Interface allows Unauthenticated Admin Password Reset9.8 Critical
- cloudcli cloud cli, siteboon claudecodeui +1 moreCloud CLI WebSocket shell injection8.7 High
- parse-community parse-serverParse Server OAuth2 authentication adapter account takeover via identity spoofing7.6 High
- parse-community parse-serverParse Server is missing audience validation in Keycloak authentication adapter7.6 High
- feathersjs feathers, @feathersjs authentication-oauth +1 moreFeathersjs has an OAuth Callback Account Takeover9.3 Critical
- craftcms cms, craft cms +1 moreCraft has a potential information disclosure vulnerability in preview tokens2.3 Low
- microsoft azure automation hybrid worker windows extensionHybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows SMB Server Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +27 more +29 moreWindows SMB Server Elevation of Privilege Vulnerability7.8 High
- themeum tutor lms proTutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login9.8 Critical
- freshrssFreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]8.2 High
- doramart doracmsdoramart DoraCMS Email API send improper authentication6.9 Medium
- Show moreLoading…