CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- ramon-victor freegpt-webuiramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication6.9 Medium
- ramon-victor freegpt-webuiramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication6.9 Medium
- jofpin trapejofpin trape Admin Endpoint sockets.py join_room missing authentication6.9 Medium
- churchcrm crmFrappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api8.2 High
- jofpin trapejofpin trape Login Endpoint stats.py missing authentication6.9 Medium
- ibm iIBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service []5.4 Medium
- ibm iIBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]8.1 High
- traefikTraefik v3.7 Authentication Bypass via TLS Option Conflict8.2 High
- traefikTraefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth9.3 Critical
- No product listedPowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution...9.8 Critical
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Authentication (CWE-287)7.1 High
- seppmail ag secure email gateway (seg)Mandatory MFA bypass before enrollment7.7 High
- tsi-coop tsi-dpdp-cmstsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication6.9 Medium
- tsi-coop tsi-dpdp-cmstsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication6.9 Medium
- rockwell automation datamosaix™ private cloudSensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud7.6 High
- unknown oauth single sign onOAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion8.1 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action8.1 High
- casdoorCasdoor upload-resource API resource.go missing authentication6.9 Medium
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint8.1 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreImproper Authentication Handling in AOS-CX Management Interface and API7.5 High
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 moreAuthentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX7.1 High
- arubanetworks fabric composerUnauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon10.0 Critical
- arubanetworks fabric composerAuthentication Bypass in HPE Networking Fabric Composer API allows Administrative Access10.0 Critical
- arubanetworks fabric composerAuthentication Bypasses in API allow Continued Authenticated Access in HPE Networking Fabric Composer5.4 Medium
- arubanetworks fabric composerAuthentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access6.8 Medium
- arubanetworks fabric composerAuthentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer9.6 Critical
- cleo harmonyCleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication5.3 Medium
- wpinsider-1 simple membershipSimple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding5.3 Medium
- devitemsllc support genix – helpdesk, ai chatbot, knowledge base & customer support ticketing systemSupport Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token8.8 High
- google androidIn handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to...9.8 Critical
- cu siliconcu silicon edit Endpoint views.py create_app missing authentication6.9 Medium
- ellite wallosWallos: OIDC account takeover via email-based account linking without `email_verified` check8.1 High
- ellite wallosWallos: Unauthenticated database replacement via import endpoint on fresh install8.2 High
- sdcb chatssdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication6.3 Medium
- tenda ac18Tenda AC18 Telnet telnet missing authentication10.0 Critical
- tenda ac1206Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication10.0 Critical
- tenda ac1206Tenda AC1206 Web UI telnet TendaTelnet missing authentication10.0 Critical
- zte zxdu68 s202 v5.0Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product9.6 Critical
- linux foundation magmaLinux Foundation Magma Registration Complete Message amf_fsm.cpp improper authentication6.9 Medium
- cyberlord92 saml single sign on – sso loginSAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning7.5 High
- jeremyevans rodauthRodauth before 2.46.0 Authentication Bypass via webauthn_login9.4 Critical
- unknown user profile builderProfile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass8.2 High
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities8.2 High
- ibm administration runtime expert for iIBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].7.5 High
- basekick-labs arcArc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset6.9 Medium
- jfrog artifactoryPotential authentication bypass leading to administrative access in Artifactory9.8 Critical
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that holds a token intended for a different purpose can authenticate, because when an...7.4 High
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreForwarding information received from a host listed as a trusted proxy is not kept separate from...4.3 Medium
- open-xchange gmbh ox dovecot ce, ox dovecot pro +1 moreAn attacker that holds an OAuth2 token granting only part of the required scopes can authenticate...5.9 Medium
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key8.7 High
- Show moreLoading…