CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- xianyulauncherXianYuLauncher: Legacy Microsoft account OAuth sign-in flow lacks PKCE and state validation5.5 Medium
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication...8.1 High
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Authentication...7.4 High
- fduflyer droneaware-node-releasesDroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover6.8 Medium
- rocket.chatRocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is...7.5 High
- caddyserver caddy, red hat hardened images +1 moreCaddy: FastCGI header normalization bypass in `forward_auth copy_headers`8.1 High
- oracle corporation outsourced mfg for discrete industries, oracle outsourced manufacturing for discrete industries +1 moreVulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business...8.8 High
- oracle corporation outsourced mfg for discrete industries, oracle outsourced manufacturing for discrete industries +1 moreVulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business...8.8 High
- oracle project portfolio analysisVulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite ...8.8 High
- oracle project portfolio analysisVulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite ...8.8 High
- oracle qualityVulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal...8.8 High
- oracle qualityVulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal...8.8 High
- oracle process manufacturing process planningVulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business...8.8 High
- oracle cost managementVulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost...8.8 High
- oracle isetupVulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger...8.8 High
- oracle cost managementVulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost...8.8 High
- oracle spares managementVulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component:...8.8 High
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...8.8 High
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...9.8 Critical
- oracle process manufacturing product developmentVulnerability in the Oracle Process Manufacturing Product Development product of Oracle E...8.8 High
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...8.8 High
- oracle siebel apps - marketingVulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)....9.8 Critical
- oracle corporation agile plm, oracle agile product lifecycle management +1 moreVulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The...9.8 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...6.5 Medium
- foremForem vulnerable to bypass of email address domain restrictions8.2 High
- nceas metacatMetacat has an unauthenticated SQL injection vulnerability9.8 Critical
- nefteprodukttekhnika llc buk ts-g gas station automation systemNefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials9.3 Critical
- openclawOpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration7.4 High
- apache cxfApache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService4.8 Medium
- phpbbImproper authentication checks in the OAuth implementation allow account hijacking even when...9.8 Critical
- openclawOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing8.7 High
- pipeboard-co meta-ads-mcpMeta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token9.1 Critical
- broadcom spring web services, spring web services +1 moreX.509 authentication bypasses Spring Security account checks5.4 Medium
- apple macos, macos monterey +1 moreA person with access to a Mac may be able to bypass Login Window. A consistency issue was...3.5 Low
- roxy-wiRoxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt8.3 High
- spring security, vmware spring security +1 moreUnauthorized User Impersonation when Using X.509 Client Certificates6.8 Medium
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +8 more +10 moreMicrosoft Cryptographic Services Elevation of Privilege Vulnerability8.4 High
- freeswitchFreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`4.3 Medium
- freeswitchFreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`5.3 Medium
- spring ldapAuthentication Bypass with Empty Password in Spring LDAP7.4 High
- dtstack taierDTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication6.9 Medium
- No product listedAn insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3...9.1 Critical
- check point security gateway, checkpoint gaia embedded, gaia os +2 more +4 moreUser Authentication Bypass in VPN Remote Access and Mobile Access9.3 Critical
- tp-link systems inc. tapo c520ws v2Whitelist Validation Bypass in TP-Link Tapo C520WS7.0 High
- defenseunicorns uds-identity-config, uds identity config +1 moreUDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator`10.0 Critical
- linqi gmbh linqiImproper Authentication Bypass in linqi CDN File Access6.9 Medium
- dts electronics industry and trade ltd. co. redline wr3200Authentication Bypass in DTS Electronics' Redline WR32009.8 Critical
- arista networks eosOn affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.8.2 High
- doorkeeper-gem doorkeeper-openid connectDoorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret6.3 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreUnverified Meeting Recording Endpoints & Permissive CORS8.8 High
- Show moreLoading…