CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- karakeep-app karakeepkarakeep-app karakeep OAuth Sign-In auth.ts improper authentication6.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authentication issue was addressed with improved state management. This issue is fixed in iOS...5.9 Medium
- uptrain-ai uptrainUpTrain has a Constant Default API Key7.7 High
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token9.3 Critical
- efm iptime a3004tEFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication10.0 Critical
- treefrogframework treefrog-frameworktreefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication6.3 Medium
- lb-link wr1210mLB-Link WR1210M Backup Endpoint backup.cgi main missing authentication5.3 Medium
- nicu micle simple jwt loginSimple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation9.1 Critical
- unknown manual image cropManual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR5.7 Medium
- tenda ac10Tenda AC10 httpd R7WebsSecurityHandler improper authentication9.3 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via WebSocket8.7 High
- unknown backup migrationBackup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login6.5 Medium
- rafasashi user session synchronizerUser Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters9.8 Critical
- 6storage rentals, sixstorage 6storage rentals +1 more6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter9.8 Critical
- redhat quay, red hat openshift update service, quay 3 +2 moreQuay: jwt claim validation bypasses in quay federated robot and sso authentication5.4 Medium
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities9.8 Critical
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities7.5 High
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities5.3 Medium
- nceas metacatMetacat has an unauthenticated SQL injection vulnerability9.8 Critical
github.com/authorizerdev/authorizerGo,govulncheck-vulndbopenSUSE +1 moreAuthorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts8.7 High- unknown epeken all kurir for woocommerceEpeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation Forgery5.9 Medium
- openchoreoOpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)5.3 Medium
- tenda ch10, ch7, ch7g +7 more +9 moreTenda CH7 RTSP/ONVIF missing authentication6.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager6.5 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i8.3 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i7.3 High
- triggerdotdev trigger.devTrigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login7.4 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in NetServer8.1 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in Host Servers8.1 High
- priority portal generator addon to priority erp (developed by soft solutions)Priority - CWE-287: Improper Authentication10.0 Critical
- unknown customer email verification for woocommerceCustomer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass9.8 Critical
- ibm doors nextIBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete request10.0 Critical
- ibm security verify access, verify identity access, verify identity access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access8.1 High
- ibm security verify access, verify identity access, verify identity access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access7.4 High
- jfrog artifactoryAnonymous user token generation exposure in JFrog Artifactory7.5 High
- jfrog artifactoryPotential remember-me authentication bypass in JFrog Artifactory5.3 Medium
- xerrors yuxiYuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse9.4 Critical
- fortinet fortiwebAn Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0...8.8 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart6.1 Medium
- fahdaslam social login, passkeys, magic link & email otp – passwordless login by ventraconnectSocial Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback8.1 High
- red hat advanced cluster management for kubernetes 2.17Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing7.5 High
- microsoft sharepoint server, sharepoint enterprise server 2016, sharepoint server 2019 +1 more +3 moreMicrosoft SharePoint Server Elevation of Privilege Vulnerability8.8 High
- zohocorp manageengine ddi centralAuthentication Bypass Leading to Account Takeover9.8 Critical
- advplyr audiobookshelfAudiobookshelf: Refresh Token Accepted on Resource Endpoints5.3 Medium
- intel proset\/wireless wifiImproper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2...6.3 Medium
- intel tdx moduleImproper authentication in the Intel(R) TDX module for some Intel(R) platforms within Ring 0:...7.0 High
- intel corporation intel(r) proset/wireless wifi software, intel proset\/wireless wifi +1 moreImproper authentication for some Intel(R) PROSet/Wireless WiFi Software within Ring 0: Kernel may...6.7 Medium
- significant-gravitas autogptAutoGPT: Webhook provider path confusion bypasses generic webhook secret verification8.2 High
- freerdpFreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)8.3 High
- portainer cePortainer Portainer CE - Authentication Bypass8.8 High
- Show moreLoading…