Weakness (CWE)
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it (1 mitigation)
-
Architecture and Design
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE-287
3,177 results · Feed
-
Medium 6.8
NextAuth.js Upstash Adapter missing token verification
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerabilit…
-
High 7.5
Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a gre…
-
High 8.6
Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusion
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication s…
-
High 8.6
matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Addi…
-
High 7.5
matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms…
-
High 7.5
Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass
An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.
-
High 8.6
Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as…
-
High 7.5
Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shie…
-
High 8.6
nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver
nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this is…
-
High 8.4
Mist vulnerable to user providing a Sudo binary for authentication checks
Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 an…
-
High 8.5
Bifrost users using basic authntication can bypass write permission limit
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only h…
-
High 7.5
OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to th…
-
High 7.7
Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library
Not invoking a call to `pam_acct_mgmt` after a call to `pam_authenticate` to check the validity of a login can lead to an authorization bypass. ### Impact #### Exploitability The attack can be carried over the network. A complex non-standard configuration or …
-
Medium 6.8
An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with p…
-
Unscored —
A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authenti…
-
Medium 6.3
Velneo vClient Improper authentication
Velneo vClient on its 28.1.3 version, does not correctly check the certificate of authenticity by default. This could allow an attacker that has access to the network to perform a MITM attack in order to obtain the user´s credentials.
-
Medium 4.2
Improper Authentication in Arvados when using PAM as identity provider
Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM) for user authentication, if a user presented valid credentials but the account is disabled or other…
-
Low 3.7
Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, validation of the authentication adapter app ID for _Facebook_ and _Spotify_ may be circumvented. Con…
-
Medium 6.5
IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensit…
-
Medium 5.3
Improper authentication in firmware for some Intel(R) SSD DC Products may allow an unauthenticated user to potentially …
-
Critical 9.8
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_acc…
-
Medium 4.3
Improper Authentication in snipe/snipe-it
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
-
Critical 9.8
The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause…
-
Critical 9.8CVE-2021-42949 Public exploit
The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session t…
-
Critical 9.8
VNCAuthProxy authentication bypass vulnerability
OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate use…
-
Critical 9.0
Access Control Bypass in Onedev
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used …
-
Medium 5.4
Missing check for expiration time of password reset token in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset link for TYPO3 backend users has never been evaluated. As a result, a password reset link could be …
-
High 7.5
SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session eve…
-
High 8.5
XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any ema…
-
High 7.5
XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and direct…
-
High 8.3
RubyGems allows creation of users with arbitrary unverified emails
RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable…
-
Medium 6.1
Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could poten…
-
High 8.8
Remote code execution in Indy's NODE_UPGRADE transaction
Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes withi…
-
High 8.3
Recovery codes abuse in SFTPGo
SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a secondary authentication factor. Because TOTPs are often configured on mobile device…
-
Critical 9.3
Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulne…
-
Critical 9.4
Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability. A remote attacker, with…
-
High 7.5
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
-
High 8.1
ECP SAML binding bypasses authentication flows
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization head…
-
Medium 4.3
WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerability
Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.
-
Critical 9.8
Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthe…