Skip to content
OpenAdvisories

Weakness (CWE)

CWE-287: Improper Authentication

Class Draft Mapping discouraged

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Source: MITRE CWE-287

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.3
    CVE-2026-105133 Exploited Public exploit EPSS 84%

    Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

    A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper auth…

    Ahsay AhsayCBS
    KEV Oct 14, 2026
  • High 8.8
    CVE-2026-59822 Exploited Public exploit

    LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallbac…

    BerriAI litellm litellm PyPI
    KEV Sep 2, 2026
  • High 7.5
    CVE-2025-61884 Exploited · Ransomware Public exploit EPSS 96%

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions…

    Oracle Oracle Configurator
    KEV Oct 20, 2025
  • High 8.2
    CVE-2024-53704 Exploited · Ransomware Public exploit EPSS 95%

    An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass auth…

    SonicWall SonicOS Network devices
    KEV Feb 18, 2025
  • High 8.8
    CVE-2024-49039 Exploited · Ransomware Public exploit EPSS 14%

    Windows Task Scheduler Elevation of Privilege Vulnerability

    Windows Task Scheduler Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 12, 2024
  • High 7.8
    CVE-2022-0492 Exploited Public exploit

    A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. T…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
    KEV Jun 2, 2026
  • High 8.2
    CVE-2021-32648 Exploited Public exploit EPSS 91%

    Account Takeover in Octobercms

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been pat…

    octobercms october october/system Packagist
    KEV Jan 18, 2022
  • High 8.8
    CVE-2020-0688 Exploited · Ransomware Public exploit EPSS 100%

    A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle …

    Microsoft Microsoft Exchange Server 2013 Microsoft Exchange Server 2016 Cumulative Update 14 Microsoft Exchange Server 2019 Cumulative Update 3
    KEV Nov 3, 2021
  • High 7.8
    CVE-2019-0543 Exploited · Ransomware Public exploit

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft …

    KEV Mar 15, 2022