CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- unknown deema payment gatewayDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook5.3 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Auth Guard improper authentication6.9 Medium
- ossrs srsOSSRS srs System API api.go systemAPI.Run missing authentication6.9 Medium
- viewsonic vcastCVE-2026-829887.5 High
- makeplane planePlane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)9.1 Critical
- makeplane planePlane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane9.8 Critical
- hewlett packard enterprise (hpe) hpe integrated lights-out (ilo) 7A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.9.0 Critical
- casdoorCasdoor API Endpoint authz_filter.go ApiFilter missing authentication6.9 Medium
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system Admin Signup signup.php missing authentication6.9 Medium
- zitadelZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations8.8 High
- zitadelZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment8.7 High
- zitadelZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers8.8 High
- ahsay ahsaycbs, cloud backup suite +1 moreAhsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication6.9 Medium
- legion of the bouncy castle inc. bc-javaMLS X.509 credential not bound to the LeafNode signature key9.2 Critical
- burstbv burst statistics – simple wordpress analytics (google analytics alternative)Burst Statistics <= 3.7.1 - Improper Authentication to Account Persistence via Share-Link Authentication Bypass via 'burst_share_token'4.3 Medium
- unknown tillkitTillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN8.2 High
- unknown wp 2faWP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay7.5 High
- onetwothreeneth hospitalmanagementsystemonetwothreeneth HospitalManagementSystem sessions.php improper authentication6.9 Medium
- parorrey json api authJSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response9.8 Critical
- paytm payment gateway, unknown paytm payment gateway +1 morePaytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback5.3 Medium
- diviengine divi membershipDivi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter9.8 Critical
- dplugins devkit proDevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow9.8 Critical
- tp-link systems inc tapo c120 v1, tp-link systems inc. tapo c200 v5 +1 moreUnauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C2008.7 High
- apache software foundation apisixApache APISIX: Openid-connect introspection validation issue5.1 Medium
- fleetdm fleetFleet before 4.87.0 Authentication Bypass via Device Identifiers9.3 Critical
- superdav42 ultimate multisite – wordpress multisite saas & waas platformUltimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter9.8 Critical
- mispMISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass7.6 High
- zongxr supermarketZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication5.3 Medium
- zongxr supermarketZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication6.9 Medium
- zongxr supermarketZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication6.9 Medium
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway improper authentication9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Improper Authentication7.5 High
- apache wss4jApache WSS4J: SAML Sender-Vouches Authentication Bypass9.8 Critical
- unknown fluentcart a new era of ecommerceFluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email6.5 Medium
- hewlett packard enterprise (hpe) instant onImproper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs6.5 Medium
- hewlett packard enterprise (hpe) instant onAuthentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint8.1 High
- hewlett packard enterprise (hpe) instant onAuthentication Bypass in a Management Protocol of HPE Networking Instant ON APs9.6 Critical
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.38.2 High
- pretixIncorrect session validation for API-uploaded files2.3 Low
- No product listedRebuild Login Endpoint login improper authentication6.9 Medium
- modsetter surfsenseMODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication6.9 Medium
- trusted domain project opendmarcTrusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication6.9 Medium
- trusted domain project opendmarcTrusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing6.9 Medium
- gz-yami mall4jmall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API5.3 Medium
- netcore nr289-geNetcore NR289-GE boa_temp process_request missing authentication10.0 Critical
- netcore nr289-geNetcore NR289-GE CGI Dispatcher boa improper authentication6.9 Medium
- kaon ar2140Improper Authentication in Kaon AR2140X5.3 Medium
- notionnext-org notionnextnotionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication6.9 Medium
- ооо нпо ритм georitmООО НПО Ритм GEOritm REST API obj-groups missing authentication6.9 Medium
- seetong t8108, t8108p, t8116 +1 more +3 moreSeetong T8108/T8108P/T8116/T8232 Debug Service improper authentication10.0 Critical
- Show moreLoading…