CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- getzep graphitigetzep graphiti REST API main.py improper authentication6.9 Medium
- cheshire-cat-ai cheshire cat aicheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication6.9 Medium
- jaychouchannel tourism-management-systemjaychouchannel Tourism-Management-System Update Endpoint missing authentication6.9 Medium
- simalexan api-lambda-send-email-sessimalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication6.9 Medium
- vvbbnn00 warp-clash-apivvbbnn00 WARP-Clash-API authorized missing authentication6.9 Medium
- unknown really simple securityReally Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion7.5 High
- mcphubMCPHub before 1.0.32 OAuth 2.0 Authentication Bypass7.6 High
- unknown frontegg saml ssoFrontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse9.8 Critical
- devolutions serverLaci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation9.2 Critical
- headroom labs headroomHeadroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)8.8 High
- sslzen ssl zen — ssl certificate installer & https redirectsSSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure5.3 Medium
- unknown advanced-customized-promptsAdvanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover9.8 Critical
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover9.8 Critical
- No product listedAn improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification...9.8 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software9.6 Critical
- rclonerclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass9.8 Critical
- traefikTraefik HTTP/3 Backend NTLM Connection Reuse9.1 Critical
- cyberpanelCyberPanel before 3.0.5 Authentication Bypass via API8.6 High
- unknown miniorange 2faminiOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout7.5 High
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication6.9 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite8.1 High
- parse-community parse-serverParse Server 9.0.0 Authentication Bypass via LDAP Empty Password9.1 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...6.4 Medium
- newfold wp plugin bluehost, wp plugin crazy domains, wp plugin hostgator +2 more +4 moreVarious Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret8.8 High
- martin nguyen next-cart store to woocommerce migrationNext-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint8.1 High
- okta access gatewayImproper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source4.8 Medium
- No product listedOpen-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication6.9 Medium
- moltis-org moltismoltis-org moltis vault.rs vault_recovery_handler missing authentication6.9 Medium
- microsoft spring cloud azure, spring cloud +1 moreSpring Cloud Azure Elevation of Privilege Vulnerability9.0 Critical
- aircheng-org iwebshop-5aircheng-org iWebShop-5 systemseller.php login improper authentication6.9 Medium
- microsoft authenticator, authenticator for android +1 moreMicrosoft Authenticator Elevation of Privilege Vulnerability8.6 High
- wwbn avideoAVideo LoginControl PGP Authentication Bypass via verifyChallenge8.6 High
- wwbn avideoAVideo Authentication Bypass via SQL Cache Invalidation8.6 High
- wwbn avideoAVideo through c3edcc274c Authorization Bypass via Session Cookie8.7 High
- No product listedAn issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers...9.8 Critical
- ash-project ash authentication oauth2 serverash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint6.3 Medium
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +19 more +21 more389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property9.8 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...6.4 Medium
- light0011 cmslight0011 cms Cookie Helper UserModel.class.php improper authentication6.9 Medium
- librenmsLibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion9.2 Critical
- tenda ac9Tenda AC9 Web Management R7WebsSecurityHandler improper authentication6.9 Medium
- sourcecodester simple traffic offense systemSourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing authentication6.9 Medium
- sourcecodester simple traffic offense systemSourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication6.9 Medium
- No product listedMstfakts College-Management-System login.php improper authentication6.9 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier9.8 Critical
- hivepress authenticationHivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator7.5 High
- coollabsio coolifyCoolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching9.2 Critical
- metagauss registrationmagicRegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation8.8 High
- inspireui mstore api – create native android & ios apps on the cloudMStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery9.8 Critical
- Show moreLoading…