CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Also known as authentification, AuthN, AuthC.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- cyberlord92 page and post restrictionPage and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication6.5 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: required actions bypassed via kc_action parameter5.4 Medium
- sylphxai pdf-reader-mcpPDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY7.5 High
- progress software ws ftp serverWeb Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server4.3 Medium
- progress software ws ftp serverSSH Multi-Factor Authentication Bypass in Progress WS_FTP Server6.8 Medium
- progress software ws ftp serverImproper Authentication in Progress WS_FTP Server10.0 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities7.5 High
- unknown all-in-one security (aios), two factor authentication +1 moreTwo Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter7.5 High
- paycomet for woocommerce, unknown paycomet for woocommerce +1 morePAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass6.5 Medium
- ssl wireless sms notification, sslplugins ssl wireless sms notification +1 moreSSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover8.1 High
- wild-apricot wild apricot loginWild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite7.5 High
- guru team bot for telegram on woocommerceBot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token9.8 Critical
- No product listedAn issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a...9.8 Critical
- walinejs walineWaline login accepts a non-string email as a match-all MongoDB query6.5 Medium
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...8.3 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- unknown unipay payment gateway for woocommerceUniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN Secret5.3 Medium
- wpfactory customer email verification for woocommerceCustomer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter4.8 Medium
- artbees jupiter x coreJupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter9.8 Critical
- jeremyckahn chitchatterjeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication5.3 Medium
- watchguard fireware osFireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking5.6 Medium
- teamviewer remote management - monitoringLocal Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows7.8 High
- oauthlibOAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow8.5 High
- opnsense coreREDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin9.3 Critical
- qode themes membershipQode Membership <= 2.0.6.2 - Authentication Bypass via Social Login9.8 Critical
- smci mbd-x12spiSupermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability7.2 High
- unknown payment integration wompiPayment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback5.3 Medium
- unknown payex payment gateway for woocommercePayex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key5.3 Medium
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System delete_admin.php missing authentication6.9 Medium
- apple macosAn authentication issue was addressed with improved state management. This issue is fixed in...8.1 High
- apple macosAn authentication issue was addressed with improved validation of user attributes. This issue is...7.8 High
- apple ipados, macos, tvos +2 more +4 moreThis issue was addressed with improved authentication. This issue is fixed in iOS 27.2 and iPadOS...7.5 High
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.1 Medium
- akuvox akubela hypanel ps51Akuvox Akubela HyPanel PS51 login improper authentication5.3 Medium
- No product listedBillaBear Installation InstallController.php processInstall missing authentication6.9 Medium
- 777genius agent-teams-ai777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication4.8 Medium
- unknown opay payment gateway for woocommerceOPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key5.3 Medium
- unknown online payments with ik pay gatewayiKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback5.3 Medium
- unknown payment gatewaynexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret5.3 Medium
- giantappman livewallpaperGiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication6.9 Medium
- parse-community parse-serverParse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses9.1 Critical
- unknown wp stripe checkoutWP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret5.3 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication6.9 Medium
- unitree robotics go2, unitreerobotics unitree go2 +1 moreUnitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation6.3 Medium
- unknown asvereinbaseasVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation9.8 Critical
fastmcpPyPI,fastmcp-slimPyPI +1 moreFastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server5.9 Medium- intranda goobi-viewer-coreGoobi viewer: OpenID JWT audience not enforced by the verifier7.4 High
- intranda goobi-viewer-coreGoobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass7.4 High
- wizlearn technologies pte. ltd. learning management systemAuthentication Bypass Vulnerability9.8 Critical
- Show moreLoading…