CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedAn issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the...9.8 Critical
- mintplex-labs anything-llmAnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization5.9 Medium
- linuxsctp: auth: verify auth requirement when auth_chunk is NULL9.8 Critical
- apache rangerApache Ranger: Privilege Escalation via URL Parameter9.8 Critical
- unknown checkviewCheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass8.8 High
- unknown block user accountBlock User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords5.4 Medium
- unknown autonettv relayAutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron8.1 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force8.1 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header8.1 High
- britcoder single sign on for tngSingle Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset9.8 Critical
- unknown arvow ai seo writerArvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling8.2 High
- code-projects task management systemcode-projects Task Management System Login index.php improper authentication6.9 Medium
- infinitewp client, unknown infinitewp client +1 moreInfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite9.8 Critical
- codepeople appointment hour bookingAppointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter5.3 Medium
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling4.8 Medium
- dell openmanage server administrator, openmanage server administrator managed node for rhel 8.10, openmanage server administrator managed node for rhel 9.4 +2 more +4 moreDell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper...7.7 High
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication8.1 High
- thimpress wp events managerWP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter9.8 Critical
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability10.0 Critical
- microsoft teamsMicrosoft Teams Elevation of Privilege Vulnerability9.6 Critical
- open-reception appointment-booking-softwareOpenReception: WebAuthn passkey injection allows account takeover9.8 Critical
- statamic cmsStatamic: Account takeover via OAuth email matching without email-verification check8.1 High
- apple macosAn authentication issue was addressed with improved state management. This issue is fixed in...9.8 Critical
- traefikTraefik: BasicAuth singleflight key collision allows authenticated identity spoofing2.1 Low
- unknown estatik real estate pluginEstatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form5.3 Medium
- wpmudev wpmu dev dashboardWPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint8.1 High
- letta-ai lettabotletta-ai LettaBot API Status Route server.ts missing authentication6.9 Medium
- progress marklogic serverAuthentication bypass in Progress MarkLogic Server ODBC App Server9.8 Critical
- iot-ecology rust-iot-platformrust-iot-platform Authentication Bypass via Non-Validated Authorization Header9.1 Critical
- unknown contest galleryContest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login7.5 High
- unknown miniorange 2faminiOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding7.5 High
- unknown wp 2faWP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider7.5 High
- glboy otp login with phone number, otp verificationLogin/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force9.1 Critical
- baserow b.v. baserowBaserow 2FA Verify Endpoint views.py verify improper authentication2.3 Low
- h3c nx15H3C NX15 networkSetup missing authentication6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client8.1 High
- hewlett packard enterprise (hpe) edgeconnect sd-wan orchestratorAuthentication bypass via spoofed HTTP headers Orchestrator REST API9.8 Critical
- samsung open source oneA vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which...8.7 High
- altium aes, asustor inc. abp +1 moreAn improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.8.5 High
- unknown monsterinsightsMonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass3.7 Low
- zyxel wax650s firmwareAn improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S...6.5 Medium
- newtype webeipNewType WebEIP EIP_Com_FileList.aspx improper authentication6.9 Medium
- redhat 389 directory server, directory server, red hat directory server 11 +8 more +10 more389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account5.4 Medium
- unknown softmarket — digital marketplaceSoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass9.1 Critical
- unknown login-socialHuge IT Login <= 1.0.4 - Unauthenticated Account Takeover7.5 High
- unknown lenxel wpLenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset8.1 High
- unknown sms alertSMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile7.5 High
- unknown authora : easy login with mobile numberAuthora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure6.5 Medium
- unknown booking for appointments and events calendarAmelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment2.7 Low
- unknown login & register formsLogin/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass8.1 High
- Show moreLoading…