CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- pocketbasePocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade6.1 Medium
- citeum openctiOpenCTI privilege escalation and unauthenticated access via default admin account9.8 Critical
- chatchat-space langchain-chatchatchatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authentication5.3 Medium
- moreconvert proMoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse9.8 Critical
- openclawOpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint6.3 Medium
- linuxcontainers incusIncus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation2.3 Low
- quarkus, red hat cryostat 4 on rhel 9, hawtio hawtio 4.4.0 +16 more +18 moreQuarkus authorization bypass via semicolon path normalization inconsistency8.8 High
- prefecthq prefectPrefectHQ prefect WebSocket Endpoint in missing authentication6.9 Medium
- prefecthq prefectPrefectHQ prefect Health Check API health endswith improper authentication6.9 Medium
- crocodilestick calibre-web-automatedcrocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authentication6.9 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication6.9 Medium
- yunaiv yudao-cloudYunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication6.9 Medium
- innocommerce innoshopinnocommerce InnoShop Installation Endpoint InstallServiceProvider.php boot improper authentication6.9 Medium
- linux, linux kernel +1 moreBluetooth: SMP: derive legacy responder STK authentication from MITM state8.8 High
- go-pkgz authauth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation9.1 Critical
- admidioAdmidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation6.8 Medium
- coredns, red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.14 +1 more +3 moreCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports8.2 High
- corednsCoreDNS TSIG authentication bypass on encrypted DNS transports8.7 High
- apache storm, apache software foundation storm client +1 moreApache Storm Client: Anonymous principal assigned on TLS client certificate verification failure6.5 Medium
- nousresearch hermes-agentNousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication6.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication6.3 Medium
- mercurycom mipc252w firmwareMERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication...9.8 Critical
- 666ghj mirofish666ghj MiroFish REST API Endpoint __init__.py create_app missing authentication6.9 Medium
- smythos sreSmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authentication6.9 Medium
- enchant97 note-markNote Mark: OIDC-registered users authenticated by submitting password "null"9.4 Critical
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy4.8 Medium
- jkroepke openvpn-auth-oauth2openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access10.0 Critical
- hkuds openharnessHKUDS OpenHarness Session Key Collision Privilege Escalation5.3 Medium
- roxy-wiRoxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass7.7 High
- rowboatlabs rowboatrowboatlabs rowboat tools_webhook app.py tool_call improper authentication6.9 Medium
- serge-chat sergeserge-chat serge Model API Endpoint model.py delete_model missing authentication6.9 Medium
- transformeroptimus superagiTransformerOptimus SuperAGI Vector Database Management Endpoint vector_dbs.py get_vector_db_details missing authentication6.9 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog Clean Endpoint views.py missing authentication6.9 Medium
- liangliangyy djangoblogliangliangyy DjangoBlog logtracks Endpoint views.py missing authentication6.9 Medium
- collabora kodexplorerkodcloud KodExplorer fileGet Endpoint share.class.php improper authentication6.9 Medium
- nhost, nhost nhost\/auth +1 moreNhost Vulnerable to Account Takeover via OAuth Email Verification Bypass9.3 Critical
- openclawOpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation9.2 Critical
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.6 Medium
- dell data domain operating system, powerprotect data domain +1 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...6.6 Medium
- budibaseBudibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints9.1 Critical
- flowiseai flowiseFlowise: AccountService resetPassword Authentication Bypass Vulnerability7.7 High
- minioMinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads8.8 High
- fatedier frpfrp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control6.5 Medium
- oxia-db oxiaOxia: OIDC token audience validation bypass via SkipClientIDCheck9.2 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreActive Directory Spoofing Vulnerability6.2 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreA improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR...6.7 Medium
- minioMinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads8.8 High
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication6.9 Medium
- zhayujie chatgpt-on-wechat cowagentzhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication6.9 Medium
- paperclipai paperclip, paperclip paperclipai, paperclipai\/server +1 more +3 morePaperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass10.0 Critical
- Show moreLoading…