CWE-303: Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 more Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2 5.4 Medium
- apache software foundation ofbiz Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover No score
- progress software ws ftp server SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server 6.8 Medium
- apache software foundation answer Apache Answer: User Center integration does not revoke first-login sessions after central account suspension 5.4 Medium
- progress moveit transfer MOVEit Transfer Identity validation flaw in SFTP authentication 7.5 High
- f5 nginx ingress controller NGINX Ingress Controller vulnerability 8.7 High
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +9 more +11 more Windows Shell Spoofing Vulnerability 6.5 Medium
- progress software corporation marklogic server Improper Kerberos server verification in Progress MarkLogic Server 7.4 High
- asynchttpclient async-http-client AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int 8.8 High
- apache software foundation impala Apache Impala: Impala Executor Webserver Auth Bypass 9.1 Critical
- pgpool global development group pgpool-ii Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an... 6.9 Medium
- bitwarden server Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation 7.7 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 more [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token 10.0 Critical
- mongodb c driver libmongoc SCRAM client nonce-validation bypass 6.3 Medium
- mitsubishi electric motion control setting, mitsubishi electric corporation gx works3 +1 more Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting 9.2 Critical
- arista networks eos On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is… 5.3 Medium
- arista networks eos On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may r… 9.2 Critical
- schneider electric modicon m580, modicon m580 safety +1 more CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could... 9.2 Critical
- okta hyperdrive, hyperdrive agent +1 more Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling 5.6 Medium
- hitachi energy microscada sys600, hitachienergy microscada x sys600 +1 more A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering... 8.5 High
- hitachi energy microscada sys600, hitachienergy microscada x sys600 +1 more A vulnerability exists in SYS600 which allows any user authenticated to the operating system of... 8.5 High
- smp46 pingvin-share-x TOTP enrollment hijack: password gate skipped due to unawaited promise 8.8 High
- ecovacs robotics deebot pro k1vac, deebot pro m1 +1 more DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket... 6.9 Medium
- vmware vcenter, cloud foundation, telco cloud infrastructure +3 more +5 more vCenter authentication-bypass vulnerability 9.8 Critical
- creativeitem ekushey project manager crm Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email 7.1 High
- eclipse jetty, eclipse foundation jetty - ee8, jetty - ee9 +2 more Digest authentication lossy encoding 8.7 High
- getgrav getgrav/grav, trilby media grav-plugin-scheduler-webhook +1 more Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit 6.9 Medium
- trilby media grav cms scheduler-webhook plugin Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check 6.3 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 +10 more +12 more Windows SMB Server Elevation of Privilege Vulnerability 8.8 High
- suse rancher Over-inclusive team membership expansion in GitHub App authentication provider for Rancher 8.8 High
- presire qsnapper Caching of Authentication allows Authentication Bypass between users in qSnapper 8.4 High
- presire qsnapper Caching of Authentication allows Authentication Bypass in qSnapper 8.4 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 more BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication 6.9 Medium
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more ASP.NET Core Elevation of Privilege Vulnerability 8.8 High
- apache cxf, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, fuse 7 +5 more +7 more Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator 9.1 Critical
- defenseunicorns uds-identity-config, uds identity config +1 more UDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator` 10.0 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 more Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh 10.0 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 more Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services 5.4 Medium
- microsoft confluence saml sso, jira saml sso, confluence saml sso plugin +1 more +3 more Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability 9.1 Critical
- bitwarden server Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key 8.6 High
- google android In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual... 8.8 High
- coredns, red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.14 +1 more +3 more CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports 8.2 High
- coredns CoreDNS TSIG authentication bypass on encrypted DNS transports 8.7 High
- apache kafka, red hat openshift serverless, build of apache camel 4 for quarkus 3 +16 more +18 more Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication 9.1 Critical
- mattermost, mattermost server +1 more Account Takeover via Substring Matching in OpenID Connect Authentication 5.7 Medium
- tillitis tkey client, tkeyclient +1 more Tillitis: TKey Client has an Error in Protocol Implementation 4.7 Medium
- micode fileexplorer MiCode FileExplorer SwiFTP Server Authentication Bypass 9.3 Critical
- sricam deviceviewer Sricam DeviceViewer 3.12.0.1 Password Change Security Bypass 5.1 Medium
- openclaw OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching 9.2 Critical
- mattermost, mattermost server +1 more Authentication bypass via userID login when email and username login are disabled 5.4 Medium
- Show olderLoading…