CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- pixelfedPixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication5.3 Medium
- openpanel-dev openpanelOpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret6.9 Medium
- wordplus better messages – chat rooms, group chat, private messages & ai chat botsBetter Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register5.3 Medium
- ibm sterling file gatewayIBM Sterling File Gateway is Vulnerable to Authentication Bypass9.1 Critical
- forget-c jellyfish ai short drama studioForget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication6.9 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Password Change password.php simpan improper authentication5.3 Medium
- qnap systems inc. qtsQTS4.8 Medium
- flycart upsellwpUpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together5.3 Medium
- nextcloud files lockAny authenticated user can lock or unlock files they do not own by targeting absolute WebDAV...6.3 Medium
- murtaza-nasir speakrSpeakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook7.1 High
- asynchttpclient async-http-clientAsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified3.7 Low
- vendurehq vendureVendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification9.1 Critical
- team-alembic ash authenticationOAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication9.1 Critical
- team-alembic ash authenticationSign-in token minted for one resource accepted by another in AshAuthentication7.6 High
- wwbn avideoAVideo LoginControl PGP Second Factor Authentication Bypass8.6 High
- go github.com/neuvector/neuvectorSAML Audience Confusion Allows Cross-SP Authentication7.6 High
- unknown login with qrLogin with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter9.8 Critical
- unknown the pressengineThe Pressengine <= 1.0 - Unauthenticated Authentication Bypass9.8 Critical
- unknown private feed keyPrivate Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter9.8 Critical
- wwbn avideoWWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash9.2 Critical
- opennhpOpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier8.7 High
- changeweder crmChangeWeDer crm improper authentication6.9 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.16, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: broker-originated username collision causes account lockout5.3 Medium
- dell objectscaleDell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication...8.1 High
- apache apache-airflow-providers-keycloak, apache software foundation airflow keycloak provider +1 moreApache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT9.8 Critical
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.1 Critical
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.8 Critical
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.8 Critical
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.1 Critical
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.1 Critical
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.1 Critical
- oracle hyperion financial managementVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component:...9.1 Critical
- oracle hyperion data relationship managementVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion ...9.1 Critical
- oracle hyperion data relationship managementVulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion ...9.1 Critical
- oracle mobile application serverVulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite ...9.8 Critical
- oracle document management and collaborationVulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business...9.8 Critical
- oracle corporation enterprise manager for fusion middlewareVulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise...9.8 Critical
- oracle webcenter enterprise captureVulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware ...9.8 Critical
- oracle applications frameworkVulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component:...9.8 Critical
- oracle business intelligence, oracle corporation business intelligence enterprise edition +1 moreVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics ...9.8 Critical
- oracle corporation bi publisherVulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform...9.8 Critical
- oracle corporation product lifecycle analyticsVulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component...9.8 Critical
- oracle data integratorVulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component:...9.8 Critical
- oracle siebel crm, oracle corporation siebel crm deployment +1 moreVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server...9.1 Critical
- oracle siebel crm, oracle corporation siebel crm deployment +1 moreVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server...9.1 Critical
- oracle siebel crm, oracle corporation siebel crm end user +1 moreVulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). ...9.1 Critical
- oracle service delivery platformVulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component:...9.8 Critical
- oracle formsVulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services,...9.8 Critical
- oracle formsVulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services,...9.1 Critical
- oracle formsVulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services,...9.8 Critical
- Show moreLoading…