CWE-636: Not Failing Securely
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Also known as Failing Open.
A kind of CWE-657 Violation of Secure Design Principles.
From the CWE List. © The MITRE Corporation.
Newest
- getgrav gravGrav Flex-Objects < 1.4.3 Authorization Bypass via API2.3 Low
- pgjdbc, postgresql jdbc driver +1 moreSilent channel-binding authentication downgrade via unsupported certificate algorithms8.2 High
- apache camel, apache software foundation camel keycloak +1 moreApache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null…9.8 Critical
- ongres scramSCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms8.2 High
- traefikTraefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails5.9 Medium
- guzzleGuzzle: Silent HTTPS-Proxy Downgrade to Cleartext5.9 Medium
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Security Feature Bypass Vulnerability8.2 High
- openclawOpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing2.3 Low
- openclawOpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers6.3 Medium
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot1.0 Low
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot1.0 Low
- modelcontextprotocol registryMCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims3.5 Low
- volcengine openvikingOpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI9.1 Critical
- free5gcfree5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors6.9 Medium
- free5gcfree5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions8.7 High
- free5gcfree5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions8.7 High
- openclawOpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback7.7 High
- helm, red hat helm cli 4.1 +1 moreHelm's plugin verification fails open when .prov is missing, allowing unsigned plugin install8.4 High
- nearform fast-jwtfast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 High
- openclawOpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass7.1 High
- openclawOpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation5.1 Medium
- pyca pyopensslpyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback1.7 Low
- openclawOpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs2.0 Low
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 morePass filter with Empty Table4.9 Medium
- mbs ubr-01 mk ii, ubr-02, ubr-lon +1 more +3 moreUse of wildcard (“*” or “all”) in Block list4.9 Medium
- jvoisin snuffleupagusSnuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package9.2 Critical
- leakingmemory vtun-ngVTun-ng's failure to initialize encryption modules may cause reversion to plaintext8.7 High
- ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +17 more +19 morenet-imap vulnerable to STARTTLS stripping via invalid response timing7.6 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreWindows BitLocker Information Disclosure Vulnerability4.2 Medium
- hashicorp vault, vault enterprise, openbao +2 moreVault Vulnerable to Denial of Service When Processing Raft Join Requests7.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +33 more +35 moreRemote Registry Service Elevation of Privilege Vulnerability8.8 High
- dynamiapps frontend admin, shabti frontend admin by dynamiapps +1 moreFrontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation9.8 Critical
- hashicorp vault, vault enterprise +1 moreVault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses6.4 Medium
- lenovo thinkpad, thinkpad p14s gen 2 firmware, thinkpad p15s gen 2 firmware +2 more +4 moreA vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen...8.4 High
- mobymoby/moby's dockerd daemon encrypted overlay network may be unauthenticated7.5 High
- mobymoby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted6.8 Medium
- mobymoby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated6.8 Medium
- splunk add-on builder, cloudconnect sdk, cloudconnect software development kit +2 moreModular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK4.8 Medium
- cisco application policy infrastructure controller, application policy infrastructure controller (apic), cloud application policy infrastructure controller +2 moreCisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability8.8 High
- lenovo 100e 2nd gen firmware, 300e 2nd gen firmware, ideapad 1-11ada05 firmware +19 more +21 moreA vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with...6.4 Medium