CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- asus routerImproper Authentication in ASUS router modules allows an unauthenticated nearby user to send an...8.7 High
- creative labs sound blaster katana v2, v2x, seFirmware verification vulnerability4.3 Medium
- okta access gatewayAuthentication Source Verification Issue in Okta Access Gateway8.1 High
- microsoft entra application proxyAAD App Proxy Elevation of Privilege Vulnerability10.0 Critical
- authlibAuthlib: Default JWT bearer grant accepts assertions for the wrong audience6.8 Medium
- authlibAuthlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)7.4 High
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass Vulnerability in the PAPI Protocol of AOS-85.3 Medium
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-88.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass leads to Sensitive Information Disclosure in AOS-88.2 High
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass Leading to Remote Code Execution in AOS-88.5 High
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access9.3 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass in the API allows Administrative Access of AOS-109.3 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access9.3 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass leads to Unauthorized Access in AOS-89.6 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass Leading to Remote Code Execution in AOS-109.6 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-89.6 Critical
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass Leading to Remote Code Execution in AOS-89.6 Critical
- filecoin-project lotusLotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix8.2 High
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP < 1.5.7 - Authentication Bypass via Preview Link Token7.5 High
- newtype infortech nt oneappNewType Infortech｜NT OneAPP - Authentication Bypass6.9 Medium
- traefikTraefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool7.0 High
- traefikTraefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision7.0 High
- oretnom23 php-travel-agency-systemoretnom23 php-travel-agency-system Session session.php missing authentication6.9 Medium
- flarum frameworkLaravel TokenGuard authentication bypass through non-string API credentials9.2 Critical
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering4.2 Medium
- momotommy file-management-systemMomoTommy file-management-system Files API FileController.php destroy missing authentication6.9 Medium
- oretnom23 file-management-system-phporetnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication6.9 Medium
- cisco emergency responder, unified communications manager, unity connection +1 more +3 moreCisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities9.8 Critical
- dhikshitha29 insurance-management-systemdhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication6.9 Medium
- apache software foundation brpcApache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth9.1 Critical
- apache software foundation brpcApache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests9.1 Critical
- apache software foundation iotdbApache IoTDB: Auth Bypass in pipeTransfer() interface9.8 Critical
- unknown cart abandonment recovery for woocommerceCart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token3.7 Low
- unknown wholesalexWholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass6.5 Medium
- unknown miniorange 2faminiOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding7.5 High
- ibm iIBM i Improper Authentication6.5 Medium
- oracle essbaseVulnerability in Oracle Essbase (component: Security). The supported version that is affected...9.8 Critical
- oracle corporation agile product lifecycle management for processVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle...9.1 Critical
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...9.8 Critical
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...7.5 High
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...9.8 Critical
- oracle identity manager connectorVulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware ...9.1 Critical
- oracle corporation fusion middleware controlVulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware ...6.6 Medium
- oracle identity managerVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End...9.8 Critical
- oracle weblogic serverVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...9.8 Critical
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...9.1 Critical
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...9.1 Critical
- oracle identity managerVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM...8.8 High
- oracle soa suiteVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric...9.8 Critical
- oracle soa suiteVulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric...9.8 Critical
- Show moreLoading…