Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
34 results · Clear filters · Feed
-
High 7.3
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper auth…
KEV Oct 14, 2026 -
Critical 9.8
Potential authentication bypass leading to administrative access in Artifactory
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
KEV Sep 2, 2026 -
Critical 9.8
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macO…
KEV Aug 18, 2026 -
Critical 9.3
Authentication Bypass in the SmartConsole Login Process Using an Application Token
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows …
KEV Jul 22, 2026 -
High 8.8
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallbac…
KEV Sep 2, 2026 -
Critical 10.0
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a su…
KEV Sep 2, 2026 -
Critical 9.3
User Authentication Bypass in VPN Remote Access and Mobile Access
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
KEV Jun 8, 2026 -
Critical 9.8
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi…
KEV Jul 15, 2026 -
Critical 10.0
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The secti…
KEV May 14, 2026 -
Critical 10.0
Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authen…
-
Critical 10.0
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remo…
KEV Feb 25, 2026 -
High 7.5
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions…
KEV Oct 20, 2025 -
Critical 9.8
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integrati…
KEV Oct 6, 2025 -
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
KEV Jul 22, 2025 -
High 8.2
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…
KEV Feb 18, 2025 -
High 8.8
Windows Task Scheduler Elevation of Privilege Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
KEV Nov 12, 2024 -
Critical 9.8
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a rem…
KEV Sep 24, 2024 -
Critical 9.8
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wi…
KEV Aug 27, 2026 -
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or r…
KEV Jul 25, 2023 -
Critical 9.8
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…
KEV Oct 11, 2022 -
High 7.8
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. T…
KEV Jun 2, 2026 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
Critical 9.8
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…
KEV Aug 21, 2024 -
High 8.2
Account Takeover in Octobercms
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been pat…
KEV Jan 18, 2022 -
Critical 10.0
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Wind…
KEV Nov 3, 2021 -
Critical 9.8
Authentication bypass in Apache Airflow
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …
KEV Jan 18, 2022 -
Critical 9.0
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…
KEV Nov 3, 2021 -
High 8.8
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle …
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft …
KEV Mar 15, 2022 -
Critical 9.8
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?image…
KEV Mar 31, 2022 -
Critical 9.8
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_add…
KEV Mar 25, 2022 -
Critical 9.8
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 1…
KEV Mar 5, 2026 -
Critical 9.8
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0…
KEV Oct 2, 2025 -
Critical 9.8
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentica…
KEV Mar 7, 2022