CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- unknown dynamickit for elementorDynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection8.8 High
- unknown chat on desk order notificationsChat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass8.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant6.8 Medium
- unknown shopmonitor.ioShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute9.8 Critical
- unknown miniorange 2faminiOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret8.1 High
- unknown flxwooFlxWoo < 3.1.1 - Unauthenticated Payment Bypass7.5 High
- google mcp-toolbox, mcp toolbox for databases +1 moreAuthentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider8.0 High
- solarwinds web help deskSolarWinds Web Help Desk SAML Authentication Bypass Vulnerability9.8 Critical
- rocket.chatRocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8,...9.8 Critical
- nodejs node, node.js +1 moreA flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions,...4.1 Medium
- unknown wp delicious, wp delicious delicious +1 moreWP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes5.3 Medium
- unknown customer switchingCustomer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution7.5 High
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsAuthentication bypass vulnerability6.5 Medium
- cyberlord92 miniorange social login and register (discord, google, twitter, linkedin)miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover8.1 High
- stiofan userswpUsersWP < 1.2.67 - Two-Factor Authentication Bypass7.4 High
- azukaar cosmos-serverCosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens5.3 Medium
- nessshon tonapipytonapi has a Webhook Custom Path Authentication Bypass7.5 High
github.com/pocket-id/pocket-id/backendGoPocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method6.0 Medium- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...4.6 Medium
- apple macosThis issue was addressed with additional restrictions on the lock screen. This issue is fixed in...2.4 Low
- jfrog artifactoryPotential authentication bypass leading to privilege escalation in Artifactory8.8 High
- unknown bookingpress-appointment-booking-proBookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug8.2 High
- unknown user frontend: ai powered frontend post submission, user directory, user profile, membership & user registrationWP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion6.5 Medium
- unknown 微信二维码登陆QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover9.1 Critical
- unknown masteriyo lmsMasteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)9.1 Critical
- elbanyaoui clover payment gateway by zaytech for woocommerceClover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order7.5 High
- mainwp child, unknown mainwp child +1 moreMainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration8.1 High
poweradmin/poweradminPackagistPoweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover8.1 High- budibaseBudibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified9.0 Critical
- getkin kin-openapikin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default9.1 Critical
- better-authbetter-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP8.7 High
- loytec l-dali, l-gate, l-inx +5 more +7 moreLoytec LINX firmware: Improper Authentication in PAM configuration8.4 High
- unknown project management, bug and issue tracking pluginSoftware Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter9.1 Critical
- microsoft azure key vaultAzure Key Vault Elevation of Privilege Vulnerability10.0 Critical
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Tampering Vulnerability10.0 Critical
- cyberlord92 saml single sign on – sso loginSAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter9.8 Critical
- progress moveit transferMFA Bypass in MOVEit Transfer7.5 High
- logtoUnverified email-based SSO account linking9.1 Critical
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter6.3 Medium
- unknown security-ninja-premiumSecurity Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa7.5 High
- oracle platform security for javaVulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ...9.8 Critical
- checkpoint multi-domain security management, quantum security management +1 moreManagement Authentication Bypass and Privilege Escalation9.1 Critical
- check point smartconsole, checkpoint multi-domain security management, quantum security management +2 moreAuthentication Bypass in the SmartConsole Login Process Using an Application Token9.3 Critical
- oracle workflowVulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow...8.1 High
- oracle applications frameworkVulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component:...8.8 High
- oracle flow manufacturingVulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component:...8.8 High
- oracle yard managementVulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component:...8.8 High
- oracle e-business suite, oracle corporation purchasing +1 moreVulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal...7.5 High
- oracle public sector financialsVulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite ...8.8 High
- oracle public sector payrollVulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component:...8.8 High
- Show moreLoading…