CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...8.0 High
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...7.6 High
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...7.1 High
- oracle webcenter portalVulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component:...9.9 Critical
- oracle webcenter sitesVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component:...8.1 High
- oracle webcenter content, oracle corporation webcenter content: imaging +1 moreVulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component:...8.8 High
- oracle transportation managementVulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component:...4.3 Medium
- oracle unified directoryVulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD...8.8 High
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...8.1 High
- oracle siebel crm, oracle corporation siebel crm integration +1 moreVulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Siebel...3.7 Low
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...9.9 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...9.8 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...8.6 High
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...9.1 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...9.9 Critical
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component:...8.8 High
- gitea open source git serverPrivilege Escalation via Access Token Scope Escalation in API9.8 Critical
- No product listedThe Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid...5.3 Medium
- freescout-help-desk freescoutFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL9.4 Critical
- freescout-help-desk freescoutFreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails8.6 High
- sailpoint identityiqSailPoint IdentityIQ Improper Bearer Token Validation Vulnerability8.8 High
- freescout-help-desk freescoutFreeScout Allows Unauthenticated Access to Legacy Attachment Files7.5 High
- neutrinolabs xrdpxrdp: No authentication required with Xvnc backend on RHEL 98.0 High
- webminWebmin 2FA requirement bypass5.3 Medium
- newpanjing simpleuinewpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication6.9 Medium
- gerapyGerapy Project Upload Endpoint views.py missing authentication6.9 Medium
- sipeed picoclawSipeed PicoClaw First Run Setup access_control.go authentication bypass6.3 Medium
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Authentication Bypass Vulnerability9.8 Critical
- sipeed picoclawSipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay6.9 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing5.3 Medium
- pipeboard-co meta-ads-mcpMeta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token7.4 High
- poco-ai poco-clawpoco-ai poco-claw executor_manager API tasks.py create_task missing authentication5.3 Medium
- getgrav grav, grav-plugin-login +1 moreGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge7.4 High
- getgrav gravGrav < 2.0.4 2FA Bypass via Secret Regeneration9.1 Critical
- broadcom spring authorization server, spring authorization server +1 moreSpring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata9.6 Critical
- tyche softwares abandoned cart lite for woocommerceAbandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token8.1 High
- unknown happy coders otp login for woocommerceHappy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user9.8 Critical
- whyour qinglongQinglong: Incomplete fix for CVE-2026-3965: Improper Authentication9.3 Critical
- wekanWekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)9.8 Critical
- wekanWekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook9.2 Critical
- lissy93 dashyDash: Users can write to config despire permissions (OIDC tested)8.2 High
- mantisbtMantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator9.3 Critical
- penpotPenpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile9.9 Critical
- dani-garcia vaultwardenVaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure6.9 Medium
- hkuds lightragLightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection9.3 Critical
- mervinpraison praisonaiPraisonAI before 4.6.78 Missing Webhook Signature Verification8.8 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing8.8 High
- unknown shibbolethShibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing8.1 High
- ciena mcp, blue planet inventory, orchestration +4 more +6 moreAuthentication Bypass in Navigator and Blue Planet Products9.8 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreRemote Access Management service/API (RPC server) Elevation of Privilege Vulnerability8.0 High
- Show moreLoading…