Weakness (CWE)
CWE-1390: Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Source: MITRE CWE-1390
134 results · Feed
-
High 8.0
Windows Kerberos Elevation of Privilege Vulnerability
Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
-
Medium 6.4
Azure DevOps Server Elevation of Privilege Vulnerability
Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
-
High 7.2
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Medium 5.9
Microsoft Configuration Manager Information Disclosure Vulnerability
Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Weak authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Bind Filter Driver Elevation of Privilege Vulnerability
Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Storage Elevation of Privilege Vulnerability
Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Management Instrumentation Elevation of Privilege Vulnerability
Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
-
Low 3.3
Windows Language Experience Service Tampering Vulnerability
Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.
-
Medium 5.5
Windows State Repository Service Tampering Vulnerability
Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally.
-
High 7.0
Windows Error Reporting Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vu…
-
Medium 6.5
Windows AppContainer Information Disclosure Vulnerability
Weak authentication in Windows AppContainer allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows App Readiness Service Tampering Vulnerability
Weak authentication in Windows App Readiness Service allows an authorized attacker to perform tampering locally.
-
High 7.5
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions…
-
Medium 4.3
WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability
Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.
-
Critical 9.1
Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in …
-
High 8.8
WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78.
-
High 7.1
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect C…
-
Critical 9.3
Improper Authentication Vulnerability in CreditNirvana Collections Platform
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication req…
-
High 8.1
Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
-
High 7.4
Azure Key Vault Security Feature Bypass Vulnerability
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.8
Windows Error Reporting Elevation of Privilege Vulnerability
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
High 7.4
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.9
Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 5.9
Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 5.3
Windows Kernel Security Feature Bypass Vulnerability
Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.
-
High 8.1
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
High 7.8
Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Print Spooler Components Elevation of Privilege Vulnerability
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
Medium 6.8
Network Device Enrollment Service (NDES) Spoofing Vulnerability
Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.
-
High 7.0
Windows Projected File System Elevation of Privilege Vulnerability
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
-
Medium 5.5CVE-2026-83681 Public exploit
Microsoft PowerToys Tampering Vulnerability
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
-
Medium 5.5
Windows Modern Device Management (MDM) Tampering Vulnerability
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
-
High 8.8CVE-2026-96940 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 8.1CVE-2026-93355 Public exploit
LiteLLM Weak JWT Authentication via Email-Based User Lookup
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without ver…
-
Critical 9.1
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE s…
-
Critical 9.1
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndP…
-
High 7.1
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authent…
-
High 8.8
SQL Server Elevation of Privilege Vulnerability
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.