CWE-303: Incorrect Implementation of Authentication Algorithm
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- espocrmEspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords8.6 High
- abb ability optimaxABB Ability OPTIMAX Authentication Bypass in Single-Sign On9.2 Critical
- abb webpro snmp card powervalue, webpro snmp card powervalue ul +1 moreAuthentication bypass by brute forcing Authentication Headers8.4 High
- mattermost, mattermost server +1 moreMattermost Jira plugin user spoofing enables Jira request forgery.7.2 High
- cal cal.comCal.com Authentication Bypass via bad TOTP + password checks9.9 Critical
- listingthemes wp directory kitWP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover10.0 Critical
- mattermost, mattermost server +1 moreAccount Takeover via Code Exchange Endpoint9.9 Critical
- mattermost, mattermost server +1 moreAccount takeover on OAuth/OpenID-enabled servers9.9 Critical
- newtec celoxa504 firmware, celoxa820 firmware +1 moreThe Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is...9.8 Critical
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability8.4 High
- python-social-auth social-app-djangoPython Social Auth - Django has unsafe account association6.3 Medium
- dell data domain operating system, powerprotect data domain with data domain operating system (dd os) of feature release, powerprotect data domain with data domain operating system (dd os) lts2023 +1 more +3 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...7.5 High
- esphome, esphome firmware +1 moreESP-IDF web_server basic auth bypass using empty or incomplete Authorization header8.1 High
- google chromeInappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a...6.5 Medium
- immich-app immichimmich allows account hijacking through oauth27.3 High
- No product listedA state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66...8.1 High
- xml-security signxmlSignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack6.9 Medium
- mattermost, mattermost server +1 moreBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server5.4 Medium
- mattermost, mattermost server +1 moreGoogle OAuth Authentication Bypass for Converted Bot Accounts4.2 Medium
- mattermost, mattermost server +1 moreUnauthorized Bot Login Using Credentials5.4 Medium
- b&r industrial automation gmbh aprolImproper session handling in B&R APROL5.5 Medium
- glpi-project glpiGLPI vulnerable to unauthorized authentication by email using the OAuthIMAP plugin6.3 Medium
- microsoft windows 11 version 24h2, windows server 2022, 23h2 edition (server core installation), windows server 2025 +3 more +5 moreWindows NTLM V1 Elevation of Privilege Vulnerability9.8 Critical
- apache kafkaApache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption5.3 Medium
- elabftweLabFTW MFA bypass5.4 Medium
- m-files, m-files server +1 moreSupport for authentication bypass condition in M-Files LDAP authentication9.2 Critical
- progress software corporation ws ftp serverMulti-Factor Authentication Bypass in Progress WS_FTP Server6.5 Medium
- mattermost, mattermost server +1 moreMFA Code Replay3.1 Low
- mattermostIncorrect Session Creation with Desktop SSO3.5 Low
- eclipse dataspace components, eclipse foundation edc, edc connector +2 moreEclipse EDC: Consumer pull transfer token validation checks not applied5.0 Medium
- fortra goanywhere mft, goanywhere managed file transfer +1 moreAuthentication bypass in GoAnywhere MFT prior to 7.6.06.5 Medium
- ivanti vtm, virtual traffic manager +1 moreIncorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1...9.8 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space...3.5 Low
- google androidIn smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE...8.8 High
- born05 craftcms plugin - two-factor authentication, two-factor authentication, craft cms +2 moreCraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use4.8 Medium
- fortra tripwire enterpriseImproper Authentication in Tripwire Enterprise 9.1.0 APIs9.3 Critical
- github enterprise serverAn authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when...10.0 Critical
- asteriskAsterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests5.8 Medium
- d-link dir-x3260, dlink dir-x3260 firmware +1 moreD-Link DIR-X3260 prog.cgi Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability8.8 High
- d-link dir-2150, dlink dir-2150 firmware +1 moreD-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability8.8 High
- d-link dir-2150, dlink dir-2150 firmware +1 moreD-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass Vulnerability8.8 High
- d-link dir-2640, dir-2640-us, dlink dir-2640 firmware +2 moreD-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability6.5 Medium
- d-link dir-2640, dir-2640-us firmware, dlink dir-2640 firmware +2 moreD-Link DIR-2640 HNAP PrivateLogin Authentication Bypass Vulnerability6.5 Medium
- python-social-auth social-app-djangosocial-auth-app-django Improper Handling of Case Sensitivity vulnerability4.9 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +31 more +33 moreWindows Kerberos Elevation of Privilege Vulnerability7.5 High
- eclipse kuraEclipse Kura LogServlet vulnerability7.5 High
- contiki-ng tinydtlsAn issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow...7.5 High
- checkmkDisabled automation users could still authenticate8.8 High
- moxa nport 6000 series, nport 6000, nport 6150-t firmware +26 more +28 moreIncorrect Implementation of Authentication Algorithm Vulnerability7.5 High
- shadow-maint shadow-utils, red hat enterprise linux 6, enterprise linux 7 +12 more +14 moreShadow-utils: possible password leak during passwd(1) change4.7 Medium
- Show moreLoading…