Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,176 results · Feed
-
Critical 10.0
Improperly configured permissions in Sealos
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluste…
-
Medium 6.2
Cisco Duo Two-Factor Authentication for macOS Authentication Bypass Vulnerability
A vulnerability in Cisco Duo Two-Factor Authentication for macOS could allow an authenticated, physical attacker to bypass secondary authentication and access an affected macOS device. This vulnerability is due to the incorrect handling of responses from Cisc…
-
Critical 9.8
CVE-2023-30945
Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker co…
-
High 7.2
Knowage-Server vulnerable to account validation bypass
Knowage is an open source analytics and business intelligence suite. Starting in version 6.0.0 and prior to version 8.1.8, an attacker can register and activate their account without having to click on the link included in the email, allowing them access to t…
-
High 8.2
Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exp…
-
Critical 9.8
Apache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentials
Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defect in the user authentication process that may succeed when invalid credentials are provided. Users a…
-
High 7.3
PuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authentication
A vulnerability was found in PuneethReddyHC Online Shopping System Advanced 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/reg.php of the component Admin Registration. The manipulation lead…
-
Medium 5.9
Rockwell Automation FactoryTalk System Services Vulnerable to a Denial-of-Service Attack
Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives. This vulnerability may…
-
Low 3.9
VMware Tools Authentication Bypass Vulnerability
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
KEV Jun 23, 2023 -
Medium 4.2
Doorkeeper Improper Authentication vulnerability
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable t…
-
Medium 5.4
Improper checks for deactivated users during login in synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web T…
-
Critical 9.1
Mobatime mobile application - Authentication bypass
Improper Authentication vulnerability in Mobatime mobile application AMXGT100 allows Authentication Bypass.This issue affects Mobatime mobile application AMXGT100 through 1.3.20.
-
High 8.6
Improper backend communication allows access and manipulation of the telemetry data
Insufficient authentication in the MQTT backend (broker) allows an attacker to access and even manipulate the telemetry data of the entire fleet of vehicles using the HopeChart HQT-401 telematics unit. Other models are possibly affected too. Multiple vulnerab…
-
Unscored —
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki…
-
Critical 9.0
Teltonika’s Remote Management System versions 4.14.0 is vulnerable to an unauthorized attacker registering previously u…
-
High 8.1
Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify d…
-
Critical 10.0CVE-2023-2024 Public exploit
Improper Authentication for OpenBlue Enterprise Manager Data Collector
Improper authentication in OpenBlue Enterprise Manager Data Collector versions prior to 3.2.5.75 allow access to an unauthorized user under certain circumstances.
-
High 8.8
Authentication to access the AC wallbox via its Bluetooth Low Energy (BLE) channel can be bypassed,
Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Sym…
-
High 8.1
OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX respon…
-
Medium 6.5
Vert.x STOMP server process client frames that would not send initially a connect frame
Vert.x STOMP is a vert.x implementation of the STOMP specification that provides a STOMP server and client. From versions 3.1.0 until 3.9.16 and 4.0.0 until 4.4.2, a Vert.x STOMP server processes client STOMP frames without checking that the client send an in…
-
High 8.1
Apache OpenMeetings: allows bypass authentication
An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0
-
Critical 9.8
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
Improper Authentication vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation. This issue affects Essential Addons for Elementor: from 5.4.0 through 5.7.1.
-
Medium 5.4
Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially …
-
Medium 5.9
An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attac…
-
Critical 9.1
DMTF-2023-0001: SPDM mutual authentication bypass
libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prior to version 2.3.1. If a device supports both DHE session and PSK session with mutual authentication…
-
Critical 9.1
effectindex/tripreporter vulnerable to improper password verification on POST `/api/v1/account/login`
`effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on an instance of `effectindex/tripreporter`, e.g. `subjective.…
-
Medium 5.1
Improper access control vulnerability in AppLock prior to SMR May-2023 Release 1 allows local attackers without proper …
-
Medium 5.1
Improper access control vulnerability in Telephony framework prior to SMR May-2023 Release 1 allows local attackers to …
-
Critical 9.3CVE-2022-30995 Public exploit
Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Pro…
-
Critical 9.8CVE-2023-30869 Scanner template
WordPress Easy Digital Downloads Plugin 3.1-3.1.1.4.1 is vulnerable to Privilege Escalation
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.
-
High 7.2
Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue a…
-
Critical 9.8
Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
-
Critical 10.0
Default Credential Vulnerability in GajShield Data Security Firewall
This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management in…
-
High 8.2CVE-2023-30845 Public exploit
ESPv2 vulnerable to JWT authentication bypass via `X-HTTP-Method-Override` header
ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override` header value to byp…
-
Low 3.3
Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, mac…
-
High 8.2
NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA …
-
Medium 4.3
Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version…
-
High 8.2
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…
KEV Apr 20, 2026 -
High 8.2CVE-2023-22893 Scanner template
Strapi does not verify the access or ID tokens issued during the OAuth flow
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authen…
-
High 8.3
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less …