CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- giteaGitea SSH certificate principal impersonation of other users7.5 High
- giteaGitea OpenID account linking without session binding5.4 Medium
- itsmeravitejak online-examination-systemitsmeravitejak Online-Examination-System admin.php isAdmin missing authentication6.9 Medium
- thorsten phpmyfaqphpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection9.3 Critical
- thorsten phpmyfaqphpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking7.7 High
- thorsten phpmyfaqphpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username7.6 High
- thorsten phpmyfaqphpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks8.6 High
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter9.1 Critical
- apache software foundation kylinApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)9.8 Critical
- apache software foundation kylinApache Kylin: Unauthenticated Metastore Cleanup9.8 Critical
- ibm iIBM i is Affected By An Improper Authentication Vulnerability in SST / DST4.3 Medium
- mlogclub bbs-gobbs-go through 4.4.6 Account Takeover via Google One Tap Login8.6 High
- manuelgalan vulnity securityVulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials8.1 High
- unknown otp login & register woocommerceOTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force7.4 High
- dimitri grassi salon booking systemSalon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token4.8 Medium
- cyberlord92 miniorange otp login, verification and sms notificationsminiOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State8.1 High
- energizelab nestjs auth serviceEnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers8.2 High
- zoneminderZoneMinder failed token handling bypasses web authentication5.3 Medium
- erudika scooldScoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access to Sensitive Configuration and Logs6.1 Medium
- canonical authdauthd: Account takeover via username fallback in identity matching after IdP email reassignment5.9 Medium
- unitronics unistream pro/unilogicUnitronics - CWE-287: Improper Authentication8.3 High
- better-authBetter Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy9.1 Critical
- @better-auth ssoBetter Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers8.6 High
- better-authbetter-auth: OAuth state can be used as a Magic Link to sign in as another user9.1 Critical
- better-authBetter Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link9.3 Critical
- error311 fileriseFileRise OIDC login can bind an attacker identity to an existing local account8.1 High
- error311 fileriseFileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)6.4 Medium
- error311 fileriseFileRise: Login Method Restriction Bypass via Direct API Access5.4 Medium
- cemtan sar2htmlcemtan sar2html sar2html.py deleteAll missing authentication6.9 Medium
- getsentry sentrySentry: Improper authentication on SAML SSO process allows user identity linking7.6 High
- tp-link systems inc. re190 v5, re200 v5, re205 v4 +13 more +15 moreImproper Authentication in Multiple TP-Link WiFi Repeaters5.9 Medium
pgbouncerAzure LinuxAuthentication bypass via second StartupMessage during SCRAM authentication in PgBouncer8.8 High- juniper networks junos os, junos os evolved +1 moreJunos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled9.3 Critical
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution9.3 Critical
- juniper networks junos osJunos OS: Unauthorized root command execution when J-Web is enabled9.3 Critical
- zulipZulip: OpenID Connect authentication ignores the email_verified claim9.1 Critical
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback7.4 High
- unknown asaas gateway for woocommerceAsaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook5.3 Medium
- ikaros-dev ikarosIkaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token8.6 High
- ibm mcp-context-forgeMCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server is affected by a bypass authentication vulnerability8.1 High
- ibm websphere application serverIBM WebSphere Application Server is affected by an authorization bypass8.0 High
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication6.9 Medium
- itsourcecode human resource management systemSourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication6.9 Medium
- 0xjacky nginx-uiNginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)7.1 High
- 0xjacky nginx-uiNginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover8.8 High
- kusalkasilva learning-management-systemKusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication6.9 Medium
- netcore nr268Netcore NR268 CGI Execution user_ok improper authentication10.0 Critical
- progress software corporation marklogic serverImproper authentication in Progress MarkLogic Server SAML processing7.5 High
- zitadelZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion9.3 Critical
- Show moreLoading…