CWE-836: Use of Password Hash Instead of Password for Authentication
The product includes a client that computes a hash of a password and sends the hash to another component, which compares the supplied hash to the hash obtained from a data store of password hashes.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- omnispace agora project Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies 9.1 Critical
- opf openproject OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects 6.5 Medium
- shenzhen i365-tech co. ltd. setracker2 parental control app (android) package com.tgelec.setracker Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication 9.2 Critical
- motioneye-project motioneye motionEye: Authentication possible via password hash 9.1 Critical
- go-vikunja vikunja Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds 4.3 Medium
- cewe photo show, cewe-photoworld cewe photo show +1 more CEWE PHOTO SHOW 6.4.3 Denial of Service via Password Field 8.7 High
- fortinet fortiweb A use of password hash instead of password for authentication vulnerability [CWE-836]... 4.4 Medium
- elog ELOG file upload stored XSS 8.6 High
- copeland e3 supervisory controller firmware, copeland lp e3 supervisory control +1 more Login to the application services using only the password hash 5.3 Medium
- smarsh telemessage, telemessage service +1 more The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to... 4.3 Medium
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x (expresscluster x) +1 more +3 more CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X... 8.8 High
- digi realport, cm firmware, connect es firmware +38 more +40 more Digi RealPort Protocol Use of Password Hash Instead of Password for Authentication 9.0 Critical
- sonicwall analytics, gms, global management system +2 more Use of password hash instead of password for authentication vulnerability in SonicWall GMS and... 9.8 Critical
- sick ftmg-esd15axx firmware, ftmg-esd20axx firmware, ftmg-esd25axx firmware +11 more +13 more Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with... 6.2 Medium
- pi-hole adminlte, web interface +1 more Improper session handling of "Remember me for 7 days" functionality 8.8 High
- velneo vclient Velneo vClient improper authentication 8.7 High
- wwbn avideo An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master... 7.2 High
- bosch rexroth indramotion mlc l20 firmware, rexroth indramotion mlc l25 firmware, rexroth indramotion mlc l40 firmware +11 more +13 more Login with hash 10.0 Critical
- dahuasecurity dh-hcvr4xxx firmware, dh-hcvr5xxx firmware, dh-ipc-hdbw13a0sn firmware +12 more +14 more A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH... 7.3 High