CWE-305: Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware8.1 High
- dahua nvr2-4ks3, xvr1b16h-i/t, xvr4232an-i/t +2 moreA vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical...2.4 Low
- curl, siemens ruggedcom rst2428p +1 morewrong proxy connection reuse with credentials6.5 Medium
- curlbad reuse of HTTP Negotiate connection6.5 Medium
- redhat keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.14 +3 more +5 moreOrg.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login8.8 High
- huawei harmonyosAuthentication bypass vulnerability in the device authentication module. Impact: Successful...9.6 Critical
- ibm mqIBM MQ is affected by an authority vulnerablility5.0 Medium
- brocade ascg, broadcom brocade active support connectivity gateway +1 moreApplication User custom defined accounts are not properly password protected in Brocade ASCG 3.4.08.3 High
- fortinet fortiosAn Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet...7.5 High
- brocade fabric os, broadcom fabric operating system +1 morePrivilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a8.5 High
- birebirsoft software and technology solutions sufirmamInformation Disclosure in Birebirsoft's Sufirmam10.0 Critical
- palantir com.palantir.aries:ariesAuthentication bypass in Aries due to misconfiguration6.6 Medium
- jamf pro[PI141230] Fixed A broken access control issue.5.3 Medium
- ibm api connectAuthentication bypass in IBM API Connect9.8 Critical
- palantir com.palantir.gotham:gluttonGlutton V1 endpoints missing authentication9.1 Critical
- nicotsx zerobyteZerobyte has Authentication Bypass by Primary Weakness9.1 Critical
- lanol filecodeboxA vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote...7.5 High
- metz connect energy-controlling ewio2-m, energy-controlling ewio2-m-bm, ethernet-io ewio2-bm +3 more +5 morePossible malfunction credential injection9.8 Critical
- mantisbtMantisBT: Authentication bypass for some passwords due to PHP type juggling8.8 High
- ibm maximo application suiteThere is a vulnerability in the IBM Maximo Manage application in IBM Maximo Application Suite for Cognos Analytics9.8 Critical
- mercku m6aOn Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.3.1 Low
- ascertia signinghubA lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8...8.1 High
- juniper junos, juniper networks junos os +1 moreJunos OS: When a user with the name ftp or anonymous is configured unauthenticated filesystem access is allowed6.9 Medium
- liquidfilesLiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset...7.3 High
- filecoin go-f3go-f3 is Vulnerable to Cached Justification Verification Bypass5.9 Medium
- huawei harmonyosBinding authentication bypass vulnerability in the devicemanager module. Impact: Successful...8.3 High
- convoypanel panelRatPanel can perform remote command execution without authorization7.7 High
- hcl software bigfix remote controlHCL BigFix Remote Control is affected by an authorization bypass vulnerability8.2 High
- filebrowserFileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout7.7 High
- huawei harmonyosAuthentication vulnerability in the distributed collaboration framework module Impact: Successful...6.9 Medium
- filebrowserFile Browser's Password Protection of Links Vulnerable to Bypass3.1 Low
- pgpool global development group pgpool-iiPgpool-II provided by PgPool Global Development Group contains an authentication bypass by...9.3 Critical
- openpubkey, openpubkey opkssh +1 moreAuthentication Bypass in OPKSSH9.3 Critical
- openpubkey, opkssh +1 moreAuthentication Bypass in OpenPubKey9.3 Critical
- schweitzer engineering laboratories sel-3350-1, sel-3355-2, sel-3360-2 +2 moreAuthentication Bypass4.4 Medium
- danfoss ak-sm 8xxa seriesAuthentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.28.2 High
- kunbus gmbh revolution pi pictoryKUNBUS Revolution Pi Authentication Bypass by Primary Weakness9.3 Critical
- kunbus gmbh revolution pi os bookwormKUNBUS Revolution Pi Authentication Bypass by Primary Weakness9.3 Critical
- crushftpCrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the...9.8 Critical
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed through improved state management. This issue is fixed in iOS 18.4 and...5.4 Medium
- apple ipados, macos, safari +2 more +4 moreThe issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and...6.7 Medium
- langgenius dify, langgenius/dify +1 moreAuthentication Bypass in langgenius/dify8.1 High
- i-drive i11, i12, i11 firmware +1 more +3 morei-Drive i11/i12 Device Pairing authentication bypass1.0 Low
- ietf rfc 7523In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0...6.9 Medium
- openid connectOpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations....6.9 Medium
- workos hosted authkitWorkOS Hosted AuthKit before 2025-01-07 allows a password authentication MFA bypass (by enrolling...6.0 Medium
- zf rssplus 2mZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness5.9 Medium
- opcfoundation ua .net standard stack, siemens industrial edge for machine tools (formerly known as "sinumerik edge"), simatic braumat +9 more +11 moreSecurity Update for the OPC UA .NET Standard Stack5.3 Medium
- lizardbyte sunshineSunshine improperly enforces pairing protocol request order7.7 High
- sonicwall sonicosSSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling...9.1 Critical
- Show moreLoading…