CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication5.3 Medium
- parse-community parse-serverParse Server 9.0.0 Authentication Bypass via Unverified Provider Identity7.4 High
- syliusSylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication8.7 High
- wolfsslClient accepts unsolicited RawPublicKey server certificate type8.3 High
- wolfsslClient session cache reference poisoning allows resumption with wrong server2.3 Low
- coollabsio coolifycoollabsio Coolify GitHub App Setup redirect missing authentication6.9 Medium
- heymrun heymHeym before 0.0.53 Authentication Bypass via Telegram Webhook8.3 High
- heymrun heymHeym before 0.0.53 Slack Webhook Signature Verification Bypass8.3 High
- heymrun heymHeym before 0.0.53 Remote Code Execution via eval() Sandbox Escape8.7 High
- cyberlord92 miniorange otp login, verification and sms notificationsminiOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter9.8 Critical
- froxlorFroxlor before 2.3.11 2FA Bypass via Namespace Confusion7.7 High
- budibase serverBudibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC9.2 Critical
- flowiseai flowiseFlowise through 3.1.4 Authentication Bypass via Email-Only SSO9.2 Critical
- flowiseai flowiseFlowise through 3.1.4 Authentication Bypass via SSO Email Match9.2 Critical
- zammadZammad: Account takeover via unverified email matching during SSO auto-link9.1 Critical
- yzcheng90 x-springbootX-SpringBoot through 6.0 Authentication Bypass via Login Code9.3 Critical
- zammadZammad: PGP signature spoofing via unvalidated verification return7.1 High
- zhistaredu startrainingzhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication6.9 Medium
- zhistaredu startrainingzhistaredu StarTraining Druid Console index.html anonymous missing authentication6.9 Medium
- gibbonedu gibbonGibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication6.9 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding6.8 Medium
- dell rugged control center (rcc)Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization...4.4 Medium
- dell rugged control center (rcc)Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization...8.1 High
- zitadelZITADEL: MFA bypass via session reuse in Login V28.2 High
- python-social-auth social-coresocial-auth-core: VK App backend accepts unsigned callback data when auth_key is missing7.4 High
- python-social-auth social-coresocial-auth-core has an Improper Authentication issue6.4 Medium
- volotat anagnorisisvolotat Anagnorisis Socket.IO Connect app.py missing authentication6.9 Medium
- goauthentik authentikauthentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage8.9 High
- goauthentik authentikauthentik: Authentication bypass via assertion confusion in SAML sources7.4 High
- norwegian cruise line door access controlCVE-2026-759077.5 High
- thorsten phpmyfaqphpMyFAQ's two-factor authentication login bypasses the password factor8.1 High
- delta electronics diaenergieAuthentication Bypass in DIAEnergie9.8 Critical
- lynn999 ethpress – web3 loginEthPress <= 2.3.5 - Unauthenticated Authentication Bypass8.1 High
- watchguard authentication gateway, authpoint authentication gateway +1 moreAuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass7.4 High
- unknown sumit payment gateway for woocommerceSUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN5.3 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers6.8 Medium
- pollen robotics reachy miniReachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device6.3 Medium
- apache software foundation dorisApache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service7.5 High
- unknown wp oauth server ( login with wordpress )WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution9.0 Critical
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities8.2 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 more[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token10.0 Critical
- nvidia infrastructure controller, infra controller +1 moreNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could...8.2 High
- dgtlmoon changedetection.iodgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication6.9 Medium
- apache software foundation tomcatApache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled9.8 Critical
- apache software foundation tomcatApache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured7.3 High
- gigatech pdv5701Gigatech PDV5701 WebSocket Service index.html missing authentication10.0 Critical
- hatchet-dev hatchethatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState7.1 High
- lucasdillmann nginx-ignitionnginx ignition has TOTP Reuse During Validity Window4.2 Medium
- omega solution hrm osOmega Solution HRM OS Role Permission API permission missing authentication6.9 Medium
- nginxproxymanager nginx-proxy-managerNginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication6.9 Medium
- Show moreLoading…