CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- jairiidriss restaurant-website-php-mysqljairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication6.9 Medium
- gitea open source git serverLFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories7.7 High
- leshchenko1979 fast-mcp-telegramfast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection9.4 Critical
- authlib joserfcjoserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)8.7 High
- mediawikiFull Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata5.3 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset9.8 Critical
- cap-go capgoCapgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth Bypass8.7 High
- ibm langflow oss, langflow +1 moreUnauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS8.2 High
- apache tomcatApache Tomcat: EncryptInterceptor not protected against replay attacks6.5 Medium
- coollabsio coolifyCoolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret7.5 High
- openidentityplatform openamOpenAM OAuth Client Impersonation via JWKS Resolver Cache7.6 High
- feehi cmsFeehi CMS REST API Endpoint articles missing authentication6.9 Medium
- documensoDocumenso Google OAuth Login handle-oauth-callback-url.ts improper authentication6.3 Medium
- kestra, kestra oss +1 moreKestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`10.0 Critical
- wolfsslMissing SNI/ALPN binding on stateful (session-ID) TLS session resumption6.0 Medium
- wolfsslTLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify6.0 Medium
- filebrowserFile Browser: Authentication Bypass via Proxy Auth Header Forgery9.1 Critical
- rocket.chatRocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay7.4 High
- rocket.chatRocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth9.3 Critical
- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreKubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body6.5 Medium
- cap-go capgoCapgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation9.3 Critical
- cap-go capgoCapgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user9.3 Critical
- theforeman foreman, red hat satellite 6.18, satellite 6.19 +1 more +3 moreForeman-mcp-server: mcp server: active session hijacking via insecure session state reuse7.8 High
- daytonaio daytonaDaytona: Cross-tenant organization takeover via invitation acceptance with an unverified email8.4 High
- revive adserverThe XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129....0.0 None
- revive adserverLow‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API...4.3 Medium
- zohocorp manageengine adselfservice plus, manageengine adaudit plus, manageengine m365 manager plus +1 more +3 moreAccount Takeover via Predictable SSO Ticket Generation9.0 Critical
- motioneye-project motioneyemotionEye: Authentication possible via password hash9.1 Critical
- paymenterPaymenter doesn't reset email verification status after email change4.3 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by an authentication bypass vulnerability7.3 High
- ibm langflow oss, langflow +1 moreUnauthenticated Flow Execution via Webhook Endpoint in Langflow OSS9.8 Critical
- berriai litellmBerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication6.9 Medium
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreBerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication6.9 Medium
- cap-go capgoCap-go - Authentication Logic Flaw in Enforce Password Policy6.9 Medium
- corewcfCoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced7.4 High
- microsoft azure active directoryAzure Active Directory Elevation of Privilege Vulnerability10.0 Critical
- quarkus, red hat cryostat 4 on rhel 9, openshift serverless +15 more +17 moreAuthentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities7.5 High
- openfga, openfga helm charts +1 moreOpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset6.8 Medium
- apache apisixApache APISIX: Improper authentication in cas-auth plugin5.3 Medium
- microsoft azure ai bot serviceAzure Bot Service Elevation of Privilege Vulnerability7.7 High
- sztheory relyraRelyra SAML SignatureValue not cryptographically verified -> authentication bypass9.1 Critical
- antonio-castellon module-auth@acastellon/auth has an authentication bypass via spoofable headers in validateToken()8.7 High
- mervinpraison praisonaiPraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication8.2 High
- mervinpraison praisonai, praisonai-platform +1 morepraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)9.8 Critical
- mervinpraison praisonaiPraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation8.2 High
- mervinpraison praisonaiPraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing8.6 High
- mervinpraison praisonaiPraisonAI recipe serve Typer command bypasses the non-localhost authentication guard8.2 High
- zitadelZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)7.4 High
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 moregoogleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)9.3 Critical
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 moregoogleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)9.3 Critical
- Show moreLoading…