Skip to content
OpenAdvisories

Weakness (CWE)

CWE-287: Improper Authentication

Class Draft Mapping discouraged

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Source: MITRE CWE-287

All Critical High Medium Low Exploited only Public exploit

96 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-25281 Public exploit Scanner template EPSS 73%

    SaltStack Salt Improper Authentication vulnerability

    An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2020-17523 Public exploit EPSS 86%

    Authentication bypass in Apache Shiro

    Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

    org.apache.shiro:shiro-web org.apache.shiro:shiro-spring org.apache.shiro:shiro-spring-boot-starter Maven
  • Critical 9.8
    CVE-2019-20933 Public exploit Scanner template EPSS 32%

    Improper Authentication in InfluxDB

    InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

    influxdb github.com/influxdata/influxdb influxdb Debian Ubuntu Go
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit Scanner template EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2020-9480 Public exploit Scanner template EPSS 30%

    Improper Authentication in Apache Spark

    In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application…

    Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.11 Maven PyPI
  • Critical 9.8
    CVE-2020-11989 Public exploit EPSS 24%

    Improper Authentication in Apache Shiro

    Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Critical 9.0
    CVE-2020-4427 Exploited Public exploit Scanner template EPSS 70%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-1937 Public exploit EPSS 76%

    Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability

    A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token …

    Cisco Cisco Unified Computing System Director Network devices
  • Critical 9.8
    CVE-2018-15727 Public exploit EPSS 63%

    Grafana Authentication Bypass

    Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

    grafana github.com/grafana/grafana Ubuntu Go
  • Critical 9.8
    CVE-2018-10561 Exploited Public exploit EPSS 93%

    An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?image…

    KEV Mar 31, 2022
  • Critical 9.8
    CVE-2018-7750 Public exploit EPSS 27%

    Paramiko not properly checking authentication before processing other requests

    transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed b…

    paramiko paramiko paramiko py3-paramiko Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2015-1187 Exploited Public exploit EPSS 83%

    The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_add…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2017-7921 Exploited Public exploit Scanner template EPSS 100%

    An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 1…

    KEV Mar 5, 2026
  • Critical 9.8
    CVE-2015-7755 Exploited Public exploit EPSS 61%

    Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0…

    KEV Oct 2, 2025
  • Critical 9.8
    CVE-2013-0625 Exploited Public exploit EPSS 94%

    Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentica…

    KEV Mar 7, 2022
  • Critical 9.4
    CVE-2012-5864 Public exploit

    Sinapsi eSolar Improper Authentication

    These Sinapsi devices do not check if users that visit pages within the device have properly authenticated. By directly visiting the pages within the device, attackers can gain unauthorized access with administrative privileges.

    Sinapsi eSolar eSolar Light eSolar DUO