CWE-289: Authentication Bypass by Alternate Name
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- dataease DataEase: Stored SQL Injection via dateFormat field templates 8.7 High
- getkin kin-openapi kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion 7.4 High
- python-social-auth social-core social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend 6.8 Medium
- netgsm WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability 5.3 Medium
- apache software foundation tomcat Apache Tomcat: Bypass of security constraints for WebSocket endpoints 9.8 Critical
- wwbn avideo AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision 5.3 Medium
- ibm security verify access, verify identity access, security verify access container +1 more +3 more Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access 8.1 High
- tangiblewp myhome core MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token 9.8 Critical
- envoyproxy envoy Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat) 5.3 Medium
- radiustheme classified listing - mobile number verification Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login 8.1 High
- wintercms winter Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads 6.8 Medium
- wpweb woocommerce - social login WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT 9.8 Critical
- ibm websphere application server, websphere application server - liberty +1 more IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability 7.5 High
- imithemes eventer Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation 9.8 Critical
- coder Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass 7.4 High
- apache software foundation shiro Apache Shiro: Authentication bypass in Guice-Web integration 8.2 High
- traefik, red hat openshift dev spaces 3.30 +1 more Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts 7.8 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +5 more +7 more Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator 9.1 Critical
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 more Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) 8.6 High
- rsyncproject rsync Rsync < 3.4.3 Authorization Bypass via Hostname Resolution 6.3 Medium
- traefik, red hat openshift dev spaces 3.28 +1 more Traefik: Forwarded alias spoofing top pre-auth decision bypass 7.8 High
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 more A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead... 7.7 High
- openclaw OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration 2.3 Low
- openclaw OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels 8.3 High
- kernel util-linux, red hat enterprise linux 10, enterprise linux 7 +4 more +6 more Util-linux: util-linux: access control bypass due to improper hostname canonicalization 3.7 Low
- apache shiro Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems 5.3 Medium
- charm soft serve, charmbracelet soft-serve +1 more Soft Serve has Critical Authentication Bypass 8.1 High
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 more A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow... 7.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 more Keycloak: keycloak idor in realm client creating/deleting 6.0 Medium
- elated themes membership Elated Membership <= 1.2 - Authentication Bypass via Social Login 9.8 Critical
- goauthentik authentik authentik deactivated service accounts can authenticate to OAuth 4.8 Medium
- conda constructor (conda) Constructor: Excessive permissions during and after installation 7.8 High
- No product listed The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login... 7.3 High
- spring security, vmware spring security +1 more CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types 7.5 High
- cryostat, red hat cryostat 4, cryostat 4 on rhel 9 +2 more Cryostat: authentication bypass if network policies are disabled 5.9 Medium
- unraid Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root... 9.6 Critical
- chimpgroup jobcareer WP JobHunt <= 7.1 - Authentication Bypass to Candidate 7.5 High
- dataease DataEase has an unauthorized vulnerability 9.3 Critical
- moodle Moodle: lesson activity password bypass through php loose comparison 5.4 Medium
- symfony, symphony php framework process +1 more Symphony has an Authentication Bypass via RememberMe 7.5 High
- ginuerzh gost Missing key verification in gost 9.8 Critical
- codename065 download manager Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary 7.5 High
- avantra server Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards,... 6.8 Medium
- drupal, drupal core +1 more Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 8.1 High
- hail Hail authentication can be bypassed by changing email address 5.3 Medium
- simplesamlphp saml2 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation 7.5 High
- dataprobe iboot pdu, iboot-pdu4-c20 firmware, iboot-pdu4-n20 firmware +20 more +22 more The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to... 7.5 High
- hedgedoc HedgeDoc API allows to hide existing notes 6.5 Medium
- cisco staros, asr 5000 series software, ultra cloud core - user plane function +2 more A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is du… 8.8 High
- dts electronics redline router, redline router firmware +1 more Authentication Bypass in Redline Router 9.8 Critical
- Show olderLoading…