Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,171 results · Feed
-
Critical 10.0
Node-SAML Contains SAML Signature Verification Vulnerability
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attack…
-
Critical 9.8
An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass a…
-
Low 3.3
HCL IEM is affected by an improper invalidation of access or JWT token vulnerability
HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization.
-
High 7.0
Bypass of Login Screen on Shared Kiosk Workstations
A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allows unauthorized access to the underlying Windows system through the already logged-in autologon ac…
-
High 7.3
Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue…
-
High —
Alchemy Non-SMA and Webauthn Account Security Advisory
### Impact A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted. ### Patches Please direct creation of new wallets to either `createSemiMod…
-
High 7.8
Insecure authentication due to missing bruteforce protection and runtime manipulation in Two App Studio Journey 5.5.6 for iOS
Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code…
-
Critical 9.6
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC …
-
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
-
High 7.3
harry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authentication
A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the file app/controllers/base.py of the component API Endpoint. The manipulation leads to missing authentic…
-
High 7.3
Metasoft 美特软件 MetaCRM debug.jsp improper authentication
A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has…
-
High 7.3
TOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authentication
A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument teln…
-
High 7.3
An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.
-
High 7.3
An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior…
-
High 7.1
An improper access control vulnerability was found in the EZ Sync Manager of ADM
An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of authorization checks on …
-
Low 3.1
Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage.
-
Critical 9.1
Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device
An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberArk believes there to …
-
Critical 9.6
Remote Code Execution in ProTNS ActADUR
Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: * Improper Neutralization of Special Elements used in a Command ('Command Injection') * Use of Hard-coded C…
-
Critical 9.8CVE-2025-52376 EPSS 14%
An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router…
-
Medium 6.5
Directus missing permission checks for manual trigger Flows
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permissions to the items …
-
High 7.3
An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
-
Critical 9.8
LB-LINK BL-WR9000 Web Interface lighttpd.cgi restore improper authentication
A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of the component Web Int…
-
Medium 4.6
An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An …
-
High 7.4CVE-2025-49812 Public exploit
Apache HTTP Server: mod_ssl TLS upgrade attack
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…
-
Medium 6.5
Microsoft SharePoint Server Spoofing Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
KEV Jul 22, 2025 -
Medium 6.9
Press has a potential 2FA bypass
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed …
-
Critical 9.1
Improper Authentication in GPS_GNSS
Cryptographic issue occurs due to use of insecure connection method while downloading.
-
Medium 6.1
An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the gar…
-
High 7.3
rowboatlabs rowboat Session route.ts PUT missing authentication
A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the component Session Hand…
-
High 7.3
SimStudioAI sim Session route.ts POST missing authentication
A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability is the function POST of the file apps/sim/app/api/files/upload/route.ts of the component Session Hand…
-
High 7.6
Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful …
-
Low 3.7
Comodo Internet Security Premium Update certificate validation
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the atta…
-
High 8.8
Security Authentication Bypass in CentralAuth
Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43…
-
Medium 5.7
Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to byp…
-
High 8.8CVE-2025-6916 Public exploit
TOTOLINK T6 formLoginAuth.htm Form_Login missing authentication
A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack…
-
Medium 6.8
A misconfigured query in UniFi Network (v9.1.120 and earlier) could allow users to authenticate to Enterprise WiFi or V…
-
Medium 5.5
authentik has Insufficient Session verification for Remote Access Control endpoint access
authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the use…
-
High 8.1
Comet System H3531 Web-based Management setupA.cfg missing authentication
A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing ma…
-
Medium 5.2
Himmelblau offline auth permits authentication with invalid Hello PIN
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an *invalid* Linux Hello PIN, provided the host is of…
-
High 8.8
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To preve…