CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedA vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an...9.8 Critical
- codeastro payroll systemitsourcecode Payroll System CRUD Operation ajax.php delete missing authentication6.9 Medium
- dell cyber recovery, powerprotect cyber recovery, power protect cyber recovery +2 moreDell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication...7.6 High
- admin by request (abr) by request (abr)Insecure PIN derivation mechanism in Admin By Request (ABR)8.8 High
- unknown blogvault backup & staging, malcare wordpress security plugin, the wp remote wordpress plugin +2 moreBlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery8.1 High
- unknown booking for appointments and events calendarAmelia < 2.4.7 - Unauthenticated Notification Queue Dispatch6.5 Medium
- No product listedDWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '...9.8 Critical
- @better-auth ssobetter-auth SSO before 1.6.27 Domain Ownership Authentication Bypass8.6 High
- apache tomcatApache Tomcat: Principal lookup can fail open in some cases8.1 High
- alluxioAlluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature9.3 Critical
- nvidia unified fabric manager enterprise - ga, unified fabric manager enterprise - lts 2023, unified fabric manager enterprise - lts 2024 +1 more +3 moreNVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component,...8.8 High
- mervinpraison praisonaiPraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secret8.2 High
- liketrek trekliketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication6.3 Medium
- liketrek trekliketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication5.3 Medium
- apache hiveApache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user7.4 High
- team-alembic ash authenticationPurpose-limited JWT accepted as full bearer authentication in AshAuthentication7.6 High
- faveo helpdeskFaveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication6.9 Medium
- filamentphp filamentFilament: App-based MFA can be bypassed when recovery codes are enabled8.1 High
- apache camelApache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by…7.5 High
- efm iptime t24000mEFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication9.3 Critical
- efm iptime t16000mEFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication10.0 Critical
- unknown smilepass selfie loginSmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication Bypass9.8 Critical
- unknown social login & sharing buttons with analytics by socleverSocial Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass9.8 Critical
- unknown wp social media loginWP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login Flow9.8 Critical
- unknown firebase authenticationFirebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim8.1 High
- managewp worker, unknown managewp worker +1 moreManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters8.1 High
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter5.4 Medium
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS8.1 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS6.5 Medium
- bigbluebuttonBigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser7.1 High
- laravel-backpack crudbackpack/crud: MyAccountController allows changing the login email without a current-password check6.5 Medium
- splunk, splunk enterprise +1 moreImproper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise8.1 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS8.2 High
- langchain-ai langgraph-apilanggraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication5.9 Medium
- cisco secure workloadCisco Secure Workload Software Security Hardening Release August 2026 - Improper Authentication Vulnerabilities10.0 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS8.2 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS9.8 Critical
- unknown saml single sign onSAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite8.8 High
- unknown membership for woocommerceMembership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass5.3 Medium
- unknown tabapay gatewayTabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback9.8 Critical
- atlassian crowd data centerThis High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE...8.8 High
- rargames 4gaboards4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment7.6 High
- rargames 4gaboards4gaBoards: Pre-Account Takeover via SSO Email Linkage8.8 High
- tp-link systems inc tapo c120 v1, tp-link tapo c120 firmware, tapo c200 firmware +1 more +3 moreUnauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C2008.7 High
- oracle financial services enterprise case managementVulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle...8.8 High
- oracle access managerVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent...9.8 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...7.5 High
- saleorSaleor: Account pre-hijacking vulnerability due to unverified anonymous order merge8.1 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.28.2 High
- Show moreLoading…