CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav grav-plugin-loginGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie8.6 High
- getgrav grav-plugin-loginGrav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form8.6 High
- progress software corporation marklogic serverImproper OAuth token validation in Progress MarkLogic Server7.5 High
- agnoagno-agi agno auth.py get_authentication_dependency missing authentication6.9 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients6.8 Medium
- samsung mobile flowImproper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to...6.1 Medium
- amoylab unlaAmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize8.8 High
- unknown disable usersDisable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords8.8 High
- unknown freeton wpFreeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter9.8 Critical
- unknown mindstien quick loginMindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter9.8 Critical
- studio-saelix senchoStudio-Saelix Sencho Login Endpoint login improper authentication6.9 Medium
- wukongopensource wukong hrmWukong_HRM through commit 186115e Authentication Bypass via ParamAspect9.3 Critical
- iflytek astron-rpaAstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token6.9 Medium
- wpo365 | seamless wordpress + microsoft integration (wpo365 | login)WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification8.1 High
- whyun wpcom memberWPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback9.8 Critical
- unknown sms alertSMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP8.1 High
- unknown contest galleryContest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN5.3 Medium
- inilerm advanced ip blockerAdvanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler9.8 Critical
- nasirahmed advanced form integration — connect forms to 300+ appsAdvanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Ac…8.1 High
- go-vikunja vikunjaVikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover7.5 High
pyload-ngPyPIpyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password8.1 High- pyloadpyLoad: Authentication bypass in API key validation (check_apikey cache)8.1 High
- smp46 pingvin-share-xPingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking9.2 Critical
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)8.1 High
- hotspotbilling phpnuxbillPHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()7.1 High
- falkordbAuthentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling9.2 Critical
- tp-link systems inc. tapo c325wb v2Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB8.7 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access9.1 Critical
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access9.1 Critical
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access8.1 High
- espocrmEspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes5.3 Medium
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway Improper Authentication9.8 Critical
- unknown ultimate multisiteUltimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter9.8 Critical
- asynchttpclient async-http-clientAsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)6.8 Medium
- wger-project wgerwger: API credentials remain valid after logout/password change4.8 Medium
- mispMISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances7.1 High
- expressgateway express-gatewayExpress Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass7.6 High
- wolfsshwolfSSHd on Windows race condition leading to logon token reused across connections7.7 High
- giteaGitea OAuth2 refresh token grant accepts access tokens9.1 Critical
- @backstage plugin-auth-backend-module-oidc-provider, backstage, linuxfoundation backstage\/plugin-auth-backend-module-oidc-provider +2 moreBackstage: Improper authentication in the OIDC provider8.1 High
- @backstage plugin-auth-node, backstage, linuxfoundation backstage\/plugin-auth-node +2 moreBackstage: Explicit negative email verification can be ignored during shared OAuth profile normalization6.8 Medium
- @backstage plugin-auth-backend-module-cloudflare-access-provider, backstage, linuxfoundation backstage\/plugin-auth-backend-module-cloudflare-access-provider +2 moreBackstage: Insufficient audience validation in the Cloudflare Access auth provider6.8 Medium
- giteaGitea WebAuthn bypass during OAuth and OIDC sign-in9.8 Critical
- giteaGitea installer authentication bypass for existing accounts8.1 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authentication Bypass Vulnerabilities in ClearPass Policy Manager9.8 Critical
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access9.8 Critical
- hewlett packard enterprise (hpe) aos-switch (aos-s)Authentication Bypass Vulnerability in the Management Interface of AOS-S9.8 Critical
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement5.4 Medium
- cloud foundry uaa, cf-deployment +1 moreUAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type7.6 High
- unknown deema payment gatewayDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return5.3 Medium
- Show moreLoading…