CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreUnauthenticated eSIM Configuration Manipulation7.2 High
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreSCREEN_CLICK Authentication Bypass9.4 Critical
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreExposed Hard-coded M3WebServer Backend API Key9.3 Critical
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreLack of MQTT Broker Topic Access Control Lists8.6 High
- cyber-iii student-management-systemealpha072 Student-Management-System Administrative Backend config.php improper authentication6.9 Medium
- froxlorFroxlor: API Authentication bypasses 2FA Authentication8.1 High
- cloudburstmc protocolCloudburstMC Protocol: Partially missing validation for FULL type authentication tokens5.3 Medium
- goauthentik authentikauthentik: SourceStage bypass via empty POST9.8 Critical
- goauthentik authentikauthentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API8.8 High
- cyber-iii student-management-systemsayan365 student-management-system improper authentication6.9 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication6.9 Medium
- armember premium – membership plugin, content restriction, member levels, user profile & user signupARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation9.8 Critical
- mispOTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled8.2 High
- unknown really simple securityReally Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip7.5 High
- nousresearch hermes-agentNousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication4.8 Medium
- cloud foundry foundation cf deployment, log-cache release +1 moreAuthentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an...7.5 High
- code-projects hotel and tourism reservation systemcode-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication6.9 Medium
- bottelet daybydaycrmBottelet DaybydayCRM Setting missing authentication5.3 Medium
- enderfga claw-orchestratorEnderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication6.9 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud: Bypass of second factor authentication on DAV endpoints5.9 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay5.9 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud: Files Lock app allows users to lock and unlock files of other users6.3 Medium
- kiteworks security-advisoriesNextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC8.1 High
- kiteworks security-advisoriesNextcloud: PIN bypass in PassCodeActivity via back button4.6 Medium
- code-projects smart parking systemcode-projects Smart Parking System Admin Endpoint missing authentication6.9 Medium
- ousl-group-brinarybrains school student management systemOUSL-GROUP-BrinaryBrains School Student Management System MY_Controller Login.php sign_auth_cookie improper authentication6.9 Medium
- No product listedOpen5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication6.9 Medium
- goauthentik authentikauthentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user8.5 High
- eugeny russhrussh server userauth state is not reset when authentication principal changes5.3 Medium
- redhat openshift router, red hat openshift container platform 4.12, openshift container platform 4.13 +10 more +12 moreOpenshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend7.4 High
- acer predator connect w6x, predator connect w6x firmware +1 morePredator Connect W6x: Improper Authentication10.0 Critical
- glboy otp login with phone number, otp verificationOTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification9.8 Critical
- frangoteam fuxaFUXA provides guest and invalid-token access to protected read APIs in secure mode5.5 Medium
- oracle rest data servicesVulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions...10.0 Critical
- oracle e-business suite, oracle corporation payroll +1 moreVulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service...8.8 High
- oracle e-business suite, oracle corporation payments +1 moreVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File...9.8 Critical
- sensiolabs symfony, symfony lox24-notifier, mailjet-mailer +2 moreSymfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection6.9 Medium
- casdoorCVE-2026-90915.3 Medium
- casdoorCVE-2026-90909.1 Critical
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +37 more +39 morePyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 High
- mennekes amtronAuthentication Bypass9.3 Critical
- mcdope pam usbpam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption7.9 High
- mcdope pam usbpam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer7.1 High
- error311 fileriseFileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret7.4 High
- ibm aspera hsts for cp4i, aspera high-speed transfer server for cloud pak for integration +1 moreAuthentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration9.1 Critical
- learnnearclub login with nearLogin with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter8.1 High
- No product listedSpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical...5.5 Medium
- 1panel-dev maxkbMaxKB: Webhook Trigger Authentication Bypass7.5 High
- kareadita kavitaKavita: Pre-Auth Account Takeover9.3 Critical
- chatwootChatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts6.8 Medium
- Show moreLoading…