Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,172 results · Feed
-
High 8.8
When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To preve…
-
Critical 10.0
Hikka vulnerable to RCE through dangling web interface
Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenticated session: attacker can use his own Telegram account to gain RCE to the server by authorizing in…
-
Critical 9.7
Hikka vulnerable to RCE through edits in a channel
Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patch…
-
High 8.7
Improper Authentication in ControlID iDSecure On-premises
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product.
-
Medium 5.6
xxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay
A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java of the com…
-
Critical 10.0CVE-2025-32975 Exploited
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14…
KEV Apr 20, 2026 -
Medium 4.3
70mai M300 RTSP Live Video Stream Endpoint 12 improper authentication
A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /livestream/12 of the component RTSP Live Video Stream Endpoint. The manipulation leads to improp…
-
Low 3.1
70mai 1S Video Services improper authentication
A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Services. The manipulation leads to improper authentication. Access to the local network is required for this attack to su…
-
Critical 9.6
Mi Connect Service APP protocol flaws lead to unauthorized access
An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to Unauthorized access to the victim’s device.
-
Medium 5.7
An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither i…
-
Critical 9.8
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or out…
-
High 8.8
An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via B…
-
High 7.4
CryptPad 2FA Bypass Vulnerability
CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain acces…
-
Critical 9.8
Permission vulnerability in the mobile application (com.afmobi.boomplayer) may lead to the risk of unauthorized operati…
-
Medium 5.2
ExtremeCloud Universal ZTNA Improper Authorization
In ExtremeCloud Universal ZTNA, a syntax error in the 'searchKeyword' condition caused queries to bypass the owner_id filter. This issue may allow users to search data across the entire table instead of being restricted to their specific owner_id.
-
High 8.1
CVE-2025-22236 salt advisory
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).
-
Medium 6.4
CVE-2024-38825 Salt Advisory
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the correspond…
-
Low 2.7
CVE-2024-38822 Salt Advisory
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
-
High 8.2
pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration
pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authent…
-
High 7.3
code-projects School Fees Payment System improper authentication
A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has…
-
High 7.3
code-projects Laundry System data missing authentication
A vulnerability classified as critical has been found in code-projects Laundry System 1.0. This affects an unknown part of the file /data/. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been …
-
Critical 9.8
Erxes Incorrect Access Control vulnerability
Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.
-
Medium 5.3
Lucky LM-520-SC/LM-520-FSC/LM-520-FSC-SAM missing authentication
A vulnerability classified as problematic was found in Lucky LM-520-SC, LM-520-FSC and LM-520-FSC-SAM up to 20250321. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be launched remo…
-
Medium 5.3
eGauge EG3000 Energy Monitor Setting missing authentication
A vulnerability was found in eGauge EG3000 Energy Monitor 3.6.3. It has been classified as problematic. This affects an unknown part of the component Setting Handler. The manipulation leads to missing authentication. It is possible to initiate the attack remo…
-
Medium 5.3
Papendorf SOL Connect Center Web Interface missing authentication
A vulnerability was found in Papendorf SOL Connect Center 3.3.0.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Web Interface. The manipulation leads to missing authentication. The attack may be launched …
-
High 7.3
TRENDnet TV-IP121W Web Interface setup.cgi improper authentication
A vulnerability has been found in TRENDnet TV-IP121W 1.1.1 Build 36 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/setup.cgi of the component Web Interface. The manipulation leads to improper authenti…
-
Medium 6.8
An issue in KeeperChat IOS Application v.5.8.8 allows a physically proximate attacker to escalate privileges via the Bi…
-
Medium 5.2
QHora
An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following v…
-
High 7.1
Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect …
-
Medium 5.4
Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group di…
-
Critical 10.0
WF Steuerungstechnik GmbH - airleader MASTER - Authentication Bypass
Improper Authentication vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Authentication Bypass.This issue affects airleader MASTER: 3.00571.
-
High 7.7
Dataease Authentication Bypass Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No …
-
High 7.3
quequnlong shiyi-blog Administrator Backend verifyPassword improper authentication
A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authenticat…
-
Medium 6.5
Apache Pekko Management, Apache Pekko Management, Apache Pekko Management, Akka Management, Akka Management, Akka Management: management API basic authentication is not effective
If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied. Users that rely on authentication instead of making sure the Management API ports are only available to trusted users are recommended to …
-
High 7.3
Netgear WNR614 URL improper authentication
A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW. It has been classified as critical. This affects an unknown part of the component URL Handler. The manipulation with the input %00currentsetting.htm leads to improper authentication. It is possible…
-
Critical 9.8
An authentication bypass vulnerability exists in HPE StoreOnce Software.
-
Medium 5.3
Multilaser Sirius RE016 Password Change cstecgi.cgi improper authentication
A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Password Change Handler. The manipulation leads to improper authentication. It is possib…
-
Medium 4.6
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS …
-
Medium 6.5
Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Auth…
-
Low 2.7
auth-js Vulnerable to Insecure Path Routing from Malformed User Input
auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to …