CWE-305: Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- haxx libcurl, debian linux, fedoraproject fedora +10 more +12 moreAn authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature...5.9 Medium
- haxx libcurl, debian linux, fedoraproject fedora +10 more +12 moreAn authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse...5.9 Medium
- foxcpp maddyFull authentication bypass if SASL authorization username is specified9.1 Critical
- froxlor, froxlor froxlor/froxlor +1 moreAuthentication Bypass by Primary Weakness in froxlor/froxlor9.8 Critical
- modoboa, modoboa modoboa/modoboa +1 moreAuthentication Bypass by Primary Weakness in modoboa/modoboa8.6 High
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreAuthentication Bypass by Primary Weakness in ikus060/rdiffweb7.2 High
- kareadita kareadita/kavita, kavitareader kavita +1 moreImproper Restriction of Excessive Authentication Attempts in kareadita/kavita9.4 Critical
- openstack barbican, redhat openstack, red hat openstack platform +1 more +3 moreA flaw was found in the openstack-barbican component. This issue allows an access policy bypass...5.9 Medium
- makedeb mistMist vulnerable to user providing a Sudo binary for authentication checks8.4 High
- openharmonymultimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.8.8 High
- openharmonyTokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerabil…6.2 Medium
- openharmonywindowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.6.2 Medium
- agentejo cockpit, cockpit-hq cockpit-hq/cockpit +1 moreImproper Removal of Sensitive Information Before Storage or Transfer in cockpit-hq/cockpit9.8 Critical
- bookwyrm-social bookwyrm-social/bookwyrm, joinbookwyrm bookwyrm +1 moreAuthentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm9.8 Critical
- mepsan usc+, stawiz usc\+\+ +1 moreWeak Authentication in Login Function of USC+7.7 High
- openvpn, debian linux, fedoraproject fedora +2 moreOpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication...9.8 Critical
- google androidWhen the device is in factory state, it can be access the shell without adb authentication...7.8 High
- google llc dart sdk, dart software development kit +1 moreAuth bypass in Dark SDK6.5 Medium
- valmet dnaRemote code execution in Valmet DNA before Collection 20218.8 High
- arista eosIn Arista's EOS software affected releases, eAPI might skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.7.4 High
- adodb adodb/adodb, adodb project adodb, debian linux +2 moreAuthentication Bypass by Primary Weakness in adodb/adodb9.1 Critical
- goautodial, goautodial api +1 moreThe GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that...7.5 High
solidus_coreRubyGemsAuthentication Bypass by CSRF Weakness9.3 Criticalrucio-webuiPyPIAuthentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webuiNo score- openvpn, openvpn 3 core library +1 moreOpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the...7.4 High
- openvpn access serverOpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass...5.3 Medium
- openvpn, canonical ubuntu linux, debian linux +1 more +3 moreOpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access...7.5 High
- digitalocean golang-nanoauth, github.com/nanobox-io/golang-nanoauth +1 moreAuthentication bypass in github.com/nanobox-io/golang-nanoauth9.1 Critical
- devolutions server, kongchuanhujiao project kongchuanhujiao +1 moreAuthentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server7.5 High
- keycloak, redhat louketo proxy +1 moreKeycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers7.3 High
- abb ability™ symphony® plus operations, symphony \+ historian, symphony \+ operations +2 moreAuthentication Bypass in Symphony Plus9.8 Critical
- siemens simatic hmi unified comfort panels, simatic hmi united comfort panels firmware +1 moreA vulnerability has been identified in SIMATIC HMI United Comfort Panels (All versions). Affected...9.8 Critical
- ncr aptra xfs, selfserv atm +1 moreNCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the...7.6 High
- ncr aptra xfs, selfserv atm +1 moreThe currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not...5.3 Medium
- netgear r6700, r6700 firmware +1 moreThis vulnerability allows network-adjacent attackers to bypass authentication on affected...6.5 Medium
- minioAuthentication bypass MinIO Admin API9.3 Critical
- keycloakKeycloak Authentication Error9.3 Critical
- keycloakKeycloak Authentication Error9.3 Critical
- samba, fedoraproject fedora, opensuse leap +2 moreA flaw was found in Samba, all versions starting samba 4.5.0 until samba 4.9.15, samba 4.10.10,...4.2 Medium
- juniper identity management serviceIncorrect messages from Juniper Identity Management Service (JIMS) can trigger Denial of Service or firewall bypass conditions for SRX series devices5.7 Medium
- canonical ubuntu linux, fedoraproject fedora, mod auth mellon project auth mellon +8 more +10 moreA vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse...8.1 High