CWE-302: Authentication Bypass by Assumed-Immutable Data
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation ofbiz Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts No score
- azuread microsoft-identity-web Microsoft Identity Web Elevation of Privilege Vulnerability 5.3 Medium
- nutanix acropolis operating system (aos) Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS 9.3 Critical
- kcp-dev kcp kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace 9.9 Critical
- weblateorg weblate Weblate: Unverified REST API email changes 3.5 Low
- ibm security verify access, verify identity access, verify identity access container +1 more +3 more Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access 8.1 High
- @tinacms graphql Subscription Authentication Bypass via Unverified connectionParams.jwt 8.2 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more .NET Security Feature Bypass Vulnerability 8.2 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more ASP.NET Core Elevation of Privilege Vulnerability 8.8 High
- fduflyer droneaware-node-releases DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover 6.8 Medium
- gitroomhq postiz-app Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery 9.9 Critical
- namelessmc nameless NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping 5.4 Medium
- dell ecs, objectscale, elastic cloud storage +2 more Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0,... 5.6 Medium
- elabftw elabftw allows MFA bypass during login 5.9 Medium
- labredescefetrj wegia WeGIA has SQL Injection via Session Variable Override in DespachoControle.php 8.8 High
- kcp kcp's cache server is accessible without authentication or authorization checks 8.2 High
- zitadel ZITADEL's truncated opaque tokens are still valid 4.3 Medium
- socomec easy config system An authentication bypass vulnerability exists in the User profile management functionality of... 7.3 High
- newtec celoxa504 firmware, celoxa820 firmware +1 more The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is... 9.8 Critical
- optimus software brokerage automation 2FA Expiry Bypass in Optimus Software's Brokerage Automation 8.1 High
- microsoft azure devops Azure DevOps Server Elevation of Privilege Vulnerability 9.0 Critical
- cisco identity services engine, identity services engine software, identity services engine passive identity connector +2 more Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass Vulnerability 4.1 Medium
- apache apisix Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect 5.3 Medium
- microsoft azure devops Azure DevOps Elevation of Privilege Vulnerability 10.0 Critical
- rupeeseed technology ventures rupeeweb Authentication Bypass Vulnerability in RupeeWeb trading platform 7.5 High
- sap se approuter node.js package Authentication bypass via authorization code injection in SAP Approuter 8.1 High
- oneidentity identity manager In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR)... 9.9 Critical
- changing information technology cgfido Changing Information Technology CGFIDO - Authentication Bypass 8.8 High
- apache hugegraph, apache software foundation hugegraph-server +1 more Apache HugeGraph-Server: Fixed JWT Token(Secret) 9.8 Critical
- digital operation services wifiburada Protection Mechanism Failure in Digital Operation Services' WiFiBurada 6.5 Medium
- microsoft airlift.microsoft.com, airlift microsoft com +1 more Airlift.microsoft.com Elevation of Privilege Vulnerability 7.3 High
- apex softcell ld dp back office, apexsoftcell ld geo +1 more OTP Bypass Vulnerability 8.7 High
- ant media server community edition Authorization bypass in Ant Media Server 5.4 Medium
- gitlab Authentication Bypass by Assumed-Immutable Data in GitLab 7.3 High
- electrolink compact dab transmitter, compact fm transmitter, digital fm transmitter +5 more +7 more Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data 8.7 High
- electrolink compact dab transmitter, compact fm transmitter, digital fm transmitter +5 more +7 more Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data 8.7 High
- typo3 Weak Authentication in Session Handling in typo3/cms-core 4.2 Medium
- apereo cas, central authentication service +1 more MFA bypass in Apereo CAS 9.8 Critical
- exagate sysguard 3001, sysguard 3001 firmware +1 more Authentication Bypass in Exagate SYSGuard 3001 9.8 Critical
- click studios passwordstate, passwordstate browser extension chrome +1 more Click Studios Passwordstate API authentication bypass by assumed-immutable data 7.3 High
- typo3 TYPO3 vulnerable to Improper Authentication in Frontend Login 5.9 Medium
- alivecor kardia, kardia app +1 more CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1... 5.2 Medium
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 more Linux Kernel LoadPin bypass via dm-verity table reload 6.9 Medium
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 more CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate... 8.8 High
- cisco secure email and web manager, content security management appliance (sma) +1 more Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability 5.4 Medium
- cisco unified communications manager Cisco Unified Communications Manager Self Care Portal Authorization Bypass Vulnerability 4.3 Medium
- openvpn access server OpenVPN Access Server older than version 2.8.4 generates new user authentication tokens instead... 7.5 High
- jqueryform php formmail generator, php formmail generator +1 more PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass 9.8 Critical