Weakness (CWE)
CWE-1390: Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Source: MITRE CWE-1390
59 results · Clear filters · Feed
-
High 8.0
Windows Kerberos Elevation of Privilege Vulnerability
Weak authentication in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
-
High 7.2
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Weak authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Windows Bind Filter Driver Elevation of Privilege Vulnerability
Weak authentication in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Storage Elevation of Privilege Vulnerability
Weak authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Management Instrumentation Elevation of Privilege Vulnerability
Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Error Reporting Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vu…
-
High 7.5
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions…
-
High 8.8
WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78.
-
High 7.1
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect C…
-
High 8.1
Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
-
High 7.4
Azure Key Vault Security Feature Bypass Vulnerability
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.8
Windows Error Reporting Elevation of Privilege Vulnerability
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
-
High 7.4
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
High 8.1
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
High 7.8
Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Print Spooler Components Elevation of Privilege Vulnerability
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Projected File System Elevation of Privilege Vulnerability
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
-
High 8.8CVE-2026-96940 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 8.1CVE-2026-93355 Public exploit
LiteLLM Weak JWT Authentication via Email-Based User Lookup
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without ver…
-
High 7.1
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authent…
-
High 8.8
SQL Server Elevation of Privilege Vulnerability
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
-
High 8.1
NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause …
-
High 7.5
WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.
-
High 7.5
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-pr…
-
High 8.8
Rockwell Automation FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation Bypass
A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for R…
-
High 8.1
Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration
An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.
-
High 7.6
FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() method in ClientReposit…
-
High 7.8
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
-
High 8.0
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be acces…
-
High 7.3CVE-2025-70994 Public exploit
Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless en…
-
High 8.2
Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allo…
-
High 8.2
Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote at…
-
High 8.1
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: …
-
High 7.6
FactoryTalk® DataMosaix™ Private Cloud – Authentication Bypass
A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day pe…
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.4
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions…
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally.