Weakness (CWE)
CWE-302: Authentication Bypass by Assumed-Immutable Data
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
How to prevent it (1 mitigation)
-
Architecture and Design, Operation, Implementation
Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)
Source: MITRE CWE-302
16 results · Clear filters · Feed
-
Medium 5.3
Microsoft Identity Web Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
-
Medium 6.8
DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover
DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an attacker could register an account using a victim's email address with an attacker-controlled passw…
-
Medium 5.4
NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callbac…
-
Medium 5.6
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication by…
-
Medium 5.9
elabftw allows MFA bypass during login
eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credenti…
-
Medium 4.3
ZITADEL's truncated opaque tokens are still valid
ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2 format truncated to 80 characters are still considered valid. Zitadel uses a symmetric AES encryptio…
-
Medium 4.1
Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass Vulnerability
A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP access restrictions and log in to the device from a disallowed IP address. This vulnerability is due to i…
-
Medium 5.3
Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect
A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the openid-connect plugin with introspection mode 2. The auth service connected to openid-connect provide…
-
Medium 6.5
Protection Mechanism Failure in Digital Operation Services' WiFiBurada
Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5.
-
Medium 5.4
Authorization bypass in Ant Media Server
Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 (tested) and po…
-
Medium 4.2
Weak Authentication in Session Handling in typo3/cms-core
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for…
-
Medium 5.9
TYPO3 vulnerable to Improper Authentication in Frontend Login
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage fol…
-
Medium 5.2
CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on An…
-
Medium 6.9
Linux Kernel LoadPin bypass via dm-verity table reload
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …
-
Medium 5.4
Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability
A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of anot…
-
Medium 4.3
Cisco Unified Communications Manager Self Care Portal Authorization Bypass Vulnerability
A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to modify data on an affected syste…