Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
853 results · Clear filters · Feed
-
Critical 9.8
Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST e…
-
Critical 9.3
Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, …
-
Critical 9.3
Authentication Bypass in the API allows Administrative Access of AOS-10
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access o…
-
Critical 9.3
Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system …
-
Critical 9.6
Authentication Bypass leads to Unauthorized Access in AOS-8
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system …
-
Critical 9.6
Authentication Bypass Leading to Remote Code Execution in AOS-10
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privi…
-
Critical 9.6
Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify sys…
-
Critical 9.6
Authentication Bypass Leading to Remote Code Execution in AOS-8
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an …
-
Critical 9.1
better-auth: OAuth state can be used as a Magic Link to sign in as another user
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting al…
-
Critical 9.2
Laravel TokenGuard authentication bypass through non-string API credentials
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…
-
Critical 9.8
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM …
-
Critical 9.1
Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a …
-
Critical 9.1
Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOpt…
-
Critical 9.8
Apache IoTDB: Auth Bypass in pipeTransfer() interface
An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.
-
Critical 9.8
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exp…
-
Critical 9.1
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
Critical 9.8
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte…
-
Critical 9.8
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). S…
-
Critical 9.1
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). S…
-
Critical 9.8
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Su…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Su…
-
Critical 9.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure …
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Su…
-
Critical 9.9
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Wor…
-
Critical 9.8
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Wor…
-
Critical 9.8
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions…
-
Critical 9.1
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
Critical 9.8
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explor…
-
Critical 9.8
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explor…
-
Critical 9.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions t…
-
Critical 9.1
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions…
-
Critical 9.8CVE-2026-101767 Public exploit
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported …
-
Critical 9.8
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: C…
-
Critical 9.1
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: …