CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- ajenti, ajenti plugin core +1 moreajenti.plugin.core has a race conditions in 2FA6.9 Medium
- ajenti, ajenti plugin core +1 morePassword bypass when 2FA is activated9.3 Critical
- go-vikunja vikunjaVikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path7.4 High
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter5.3 Medium
- fluxcd notification-controllerFlux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering3.1 Low
- apache tomcatApache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled6.5 Medium
- apache tomcat, tomcat native +1 moreApache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled9.1 Critical
- gl.inet gl-rm1, gl-rm10, gl-rm10rc +1 more +3 moreGL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authentication7.5 High
- laravel passportLaravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens7.1 High
- lobehubLobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header5.0 Medium
- eclipse jetty, red hat hawtio hawtio 4.4.0, build of apache camel 4.18.1 for spring boot 3.5.14 +6 more +8 moreDuplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables7.4 High
- polarlearnPolarLearn: Any password authenticates banned accounts and grants API access9.2 Critical
- openclawOpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication2.3 Low
- rack rack-sessionRack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization9.3 Critical
- totolink a8000rTotolink A8000R cstecgi.cgi setLanguageCfg missing authentication6.9 Medium
- assafelovic gpt-researcherassafelovic gpt-researcher HTTP REST API Endpoint missing authentication6.9 Medium
- No product listedJeecgBoot AI Chat JeecgBizToolsProvider.java missing authentication6.9 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 LoginCB index_config improper authentication6.9 Medium
- badlogic pi-monobadlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass5.3 Medium
lightrag-hkuPyPILightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass7.5 High- prosoft technology icx35-hwc cellular gateway, prosoft-technology icx35-hwc firmware +1 moreProSoft Technology ICX35-HWC Authentication Bypass9.3 Critical
- belden hirschmann hios, hirschmann hisecos eagle +1 moreHirschmann HiOS HiSecOS Authentication Bypass via HTTP Management9.3 Critical
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +3 more +5 moreLiteLLM has an authentication bypass via OIDC userinfo cache key collision9.4 Critical
- jupyter oauthenticatorOAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims8.8 High
- openprinting cupsOpenPrinting CUPS: Local print admin token disclosure using temporary printers5.0 Medium
- belden hirschmann industrial hivisionHirschmann Industrial HiVision Authentication Bypass Remote Code Execution9.3 Critical
- linux, linux kernel +1 moresmb: client: fix krb5 mount with username option8.1 High
- microsoft azure sre agent, azure sre agent gateway - signalr hub +1 moreAzure SRE Agent Information Disclosure Vulnerability8.6 High
- belden hirschmann hieos lrs11Hirschmann HiEOS Authentication Bypass via HTTP Management Module9.3 Critical
- bulwarkmail webmailBulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation8.7 High
- openedx openedx-platformOpen edX Platform: Account Activation Bypass via activation_key Exposure in REST API5.3 Medium
- tp-link systems inc. tapo c520ws v2.6, tp link systems inc. tapo c210 v3.6, tp-link tapo c520ws firmware +2 moreAuthentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C2108.7 High
- convoypanel convoy, panel +1 moreConvoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users9.8 Critical
- vanna-ai vannavanna-ai vanna Chat API Endpoint v2 missing authentication6.9 Medium
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access8.1 High
- fccview cronmastercronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution8.3 High
- devolutions serverImproper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11...5.4 Medium
- canonical jujuImproper TLS Client/Server authentication and certificate verification on Database Cluster10.0 Critical
- unknown order notification for woocommerceOrder Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission Bypass9.1 Critical
- xenforoXenForo Passkey Security Bypass9.3 Critical
- trustedfirmware mbed tlsAn issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while...9.1 Critical
- openclawOpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding7.4 High
- miguelgrinberg flask-httpauthFlask-HTTPAuth invokes token verification callback when missing or empty token was given by client6.5 Medium
- frentix openolatOpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow9.8 Critical
- lollms, parisneo parisneo/lollms +1 moreUnauthenticated File Upload in parisneo/lollms7.5 High
- promtengineer localgptPromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication6.9 Medium
- minioMinIO is Vulnerable to SSE Metadata Injection via Replication Headers7.1 High
- fleetdm fleetFleet's user account creation via invite does not enforce invited email address4.9 Medium
- openbmb xagentOpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication6.9 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 moreDoveadm credentials are verified using direct comparison which is susceptible to timing oracle...7.4 High
- Show moreLoading…