Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
871 results · Clear filters · Feed
-
Medium 5.4
Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group di…
-
Medium 6.5
Apache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effective
If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication instead of making sure the Management API ports are only available to trusted users are recommended to …
-
Medium 5.3
Multilaser Sirius RE016 Password Change cstecgi.cgi improper authentication
A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possib…
-
Medium 4.6
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS …
-
Medium 6.5
Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Auth…
-
Medium 5.6
WCMS Login getallcon getMemberByUid improper authentication
A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function getMemberByUid of the file /index.php?articleadmin/getallcon of the component Login. The manipulation of the argument uid leads to…
-
Medium 5.8
Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Exploitation of this vulnerability could enable malicious actors…
-
Medium 6.5
An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur.
-
Medium 6.4
Nextcloud Server doesn't request second factor after session timeout
Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug ca…
-
Medium 6.5
Microsoft Defender for Identity Spoofing Vulnerability
Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network.
-
Medium 6.8
The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. A…
-
Medium 6.3
Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vu…
-
Medium 5.3
TOTOLINK A720R cstecgi.cgi missing authentication
A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input RebootSystem leads to missing authentic…
-
Medium 6.5
An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows…
-
Medium 5.3
PKCE bypass via downgrade attack
PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloud…
-
Medium 6.5
Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote…
-
Medium 6.5
Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote…
-
Medium 5.4
Org.keycloak.authentication: two factor authentication bypass
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
-
Medium 5.3
20120630 Novel-Plus CrawlController.java addCrawlSource missing authentication
A vulnerability, which was classified as critical, has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This issue affects the function addCrawlSource of the file novel-crawl/src/main/java/com/java2nb/novel/controller/CrawlCon…
-
Medium 5.3
20120630 Novel-Plus SessionController.java list missing authentication
A vulnerability was found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. It has been rated as critical. Affected by this issue is the function list of the file novel-system/src/main/java/com/java2nb/system/controller/SessionController.…
-
Medium 4.3
Moodle: partial data exposure in moodle before completing multi-factor authentication
A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA).
-
Medium 4.3
Moodle: moodle allows course self-enrolment before completing mfa
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verifica…
-
Medium 5.3
BEC Technologies Multiple Routers Authentication Bypass Vulnerability
BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability. The…
-
Medium 6.5
Vulnerability in the RDBMS Listener component of Oracle Database Server. Supported versions that are affected are 19.3-…
-
Medium 5.9
An issue in the web socket handshake process of SteVe v3.7.1 allows attackers to bypass authentication and execute arbi…
-
Medium 6.5
In JotUrl 2.0, is possible to bypass security requirements during the password change process.
-
Medium 5.6
WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability
In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup.
-
Medium 5.3
Spring Cloud Config Server May Not Use Vault Token Sent By Clients
Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: * You have Spring Vault on the classpath of your Spring Cloud C…
-
Medium 5.3
qinguoyi TinyWebServer http_conn.cpp improper authentication
A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_conn.cpp. The manipulation of the argument m_url_real leads to improper authentication. The attack can…
-
Medium 6.4
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.…
-
Medium 6.6
Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010
Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.
-
Medium 6.6
Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006
Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.
-
Medium 6.9
Improper Authentication vulnerability in saTECH BCU
An attacker with network access, could capture traffic and obtain user cookies, allowing the attacker to steal the active user session and make changes to the device via web, depending on the privileges obtained by the user.
-
Medium 6.9
Parse Server has an OAuth login vulnerability
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication provi…
-
Medium 5.5
Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances sec…
-
Medium 5.3
IROAD Dash Cam X5/Dash Cam X6 API Endpoint missing authentication
A vulnerability, which was classified as critical, has been found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this issue is some unknown functionality of the component API Endpoint. The manipulation leads to missing authentication. The at…
-
Medium 5.3
otale Tale Blog logs improper authentication
A vulnerability was found in otale Tale Blog 2.0.5. It has been classified as problematic. This affects an unknown part of the file /%61dmin/api/logs. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The explo…
-
Medium 5.8
Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeover
Froxlor is open-source server administration software. A vulnerability in versions prior to 2.2.6 allows users (such as resellers or customers) to create accounts with the same email address as an existing account. This creates potential issues with account i…
-
Medium 6.8
CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized us…
-
Medium 5.1
An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "…