Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
12 results · Clear filters · Feed
-
High 7.3
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper auth…
KEV Oct 14, 2026 -
High 7.5CVE-2026-42018 Exploited
Anonymous user token generation exposure in JFrog Artifactory
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
KEV Sep 11, 2026 -
High 8.8
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallbac…
KEV Sep 2, 2026 -
High 7.5
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions…
KEV Oct 20, 2025 -
High 8.2
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…
KEV Feb 18, 2025 -
High 8.8
Windows Task Scheduler Elevation of Privilege Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
KEV Nov 12, 2024 -
High 8.2
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…
KEV Apr 20, 2026 -
High 7.8
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. T…
KEV Jun 2, 2026 -
High 8.2
Account Takeover in Octobercms
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been pat…
KEV Jan 18, 2022 -
High 7.5
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a u…
KEV Nov 3, 2021 -
High 8.8
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle …
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft …
KEV Mar 15, 2022