Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,173 results · Feed
-
Low 3.5
Jetty's OpenId Revoked authentication allows one request
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revok…
-
Medium 5.9
Supcon InPlant SCADA Project.xml improper authentication
A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The manipulation leads to improper authentication. An attack has to be approached locally. The exploit has b…
-
Medium 6.5
PaperCut NG Unauthenticated XMLRPC
PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.
-
Critical 9.8
Authentication bypass in OpenText (Micro Focus) Enterprise Server
User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL Server, Enterprise Developer, and Enterprise Server (including product variants such as Enterprise Test Server), versions 7.0 patch updates…
-
High 8.8
Pavilion8 Security Misconfiguration Vulnerability
The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could potentially retrieve other application users’ session data and or log users out of their session.
-
Medium 6.9
A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password…
-
Critical 10.0CVE-2023-20238 EPSS 15%
A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco …
-
Medium 6.3
Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acro…
-
Medium 6.5
Walchem Intuition Improper Authentication
Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format that could allow an attacker to use them as-is to login and gain access to the device.
-
Medium 5.4
Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in …
-
High 7.5
Authentication Bypass in Danfoss AK-SM800A
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information.
-
Critical 9.8
Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager v…
-
High 7.3
Ruijie RG-EW1200G login improper authentication
A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotel…
-
Medium 4.6
Dell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may po…
-
Critical 9.9
Improper Authentication in PrivateUploader
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the req…
-
Medium 6.5
Sentry vulnerable to incorrect credential validation on OAuth token requests
Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due …
-
Medium 4.3
FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above …
-
High 8.1
Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, includ…
-
High 8.7CVE-2023-0264 Public exploit
Keycloak vulnerable to user impersonation via stolen UUID code
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and g…
-
Medium 5.0
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
matrix-appservice-bridge provides an API for setting up bridges. Starting in version 4.0.0 and prior to versions 8.1.2 and 9.0.1, a malicious Matrix server can use a foreign user's MXID in an OpenID exchange, allowing a bad actor to impersonate users when usi…
-
Critical 9.1
A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow …
-
Medium 4.3
Access Control Bypass Vulnerability in the SolarWinds Platform
Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource
-
High 7.5
Authentication Bypass in OpenThread Boarder Router devices
There exists an authentication bypass vulnerability in OpenThread border router devices and implementations. This issue allows unauthenticated nodes to craft radio frames using “Key ID Mode 2”: a special mode using a static encryption key to bypass security c…
-
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or r…
KEV Jul 25, 2023 -
Medium 6.8
API token authentication bypass in HTTP endpoints in Dapr
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from t…
-
Critical 9.1
User impersonation using SAMLv1.x SSO in Open Access Management
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses recei…
-
Critical 9.8
GeoVision GV-ADR2701 Improper Authentication
In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
-
High 8.8CVE-2022-34155 Public exploit
WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
-
Critical 9.8CVE-2023-37266 Scanner template
Weak json web token (JWT) secrets in CasaOS
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances. This problem was addressed by improving th…
-
Medium 4.8
Lack of previous password reset tokens on new token creation
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
-
Low 2.7
IBM Robotic Process Automation security bypass
IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could allow invalid changes or values in some fields. IBM X-Force ID: 259380.
-
Medium 6.4
User login confusion with SSO in warpgate
Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be c…
-
Medium 6.8
PCU Configuration Lacks Authentication
The configuration from the PCU can be modified without authentication using physical connection to the PCU.
-
None 0.0
Apache Pulsar: Broker does not always disconnect client when authentication data expires
Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authen…
-
High 7.5
Improper Authentication in iSTAR
An unauthenticated user could log into iSTAR Ultra, iSTAR Ultra LT, iSTAR Ultra G2, and iSTAR Edge G2 with administrator rights.
-
High 7.5
GLPI vulnerable to unauthenticated access to Dashboard data
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this i…
-
High 7.3
Sealos billing system permission control defect
Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, res…
-
Critical 10.0
Improperly configured permissions in Sealos
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluste…
-
Medium 6.2
Cisco Duo Two-Factor Authentication for macOS Authentication Bypass Vulnerability
A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This vulnerability is due to the incorrect handling of responses from Cisc…
-
Critical 9.8
CVE-2023-30945
Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker co…