Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,167 results · Feed
-
High 8.4
Loytec LINX firmware: Improper Authentication in PAM configuration
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root sh…
-
Critical 9.1
Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in th…
-
Critical 10.0
Azure Key Vault Elevation of Privilege Vulnerability
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Exchange Online Tampering Vulnerability
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
-
Critical 9.8CVE-2026-15981 Public exploit
SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer…
-
High 7.5
MFA Bypass in MOVEit Transfer
Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
-
Critical 9.1
Unverified email-based SSO account linking
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.
-
Medium 6.3
Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the `wpdmppdl` parameter. This is due to the `download()` function — hooked to the unauthenticate…
-
High 7.5
Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without t…
-
Critical 9.8
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thir…
-
Critical 9.1
Management Authentication Bypass and Privilege Escalation
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow comman…
-
Critical 9.3
Authentication Bypass in the SmartConsole Login Process Using an Application Token
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows …
KEV Jul 22, 2026 -
High 8.1
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supp…
-
High 8.8
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Suppo…
-
High 8.8
Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Suppor…
-
High 8.8
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Sup…
-
High 7.5
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported v…
-
High 8.8
Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). …
-
High 8.8
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations…
-
High 8.8
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported vers…
-
High 8.8
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versi…
-
High 8.8
Vulnerability in the TeleSales product of Oracle E-Business Suite (component: Internal Operations). Supported versions …
-
High 8.8
Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported ver…
-
High 8.8
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported …
-
High 8.8
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Staffi…
-
Critical 9.8
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Integrati…
-
High 8.1
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Co…
-
High 7.5
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: I…
-
Critical 9.8
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: R…
-
High 8.8
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
High 8.8
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
Critical 9.8
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: I…
-
High 8.8
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that …
-
High 8.1
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…
-
Critical 9.8
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The…
-
High 8.8
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (com…
-
High 8.1
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…
-
Critical 9.8
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The…
-
Critical 9.8
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported versio…
-
High 8.8
Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Solu…