Skip to content
OpenAdvisories

Weakness (CWE)

CWE-305: Authentication Bypass by Primary Weakness

Base Draft

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Source: MITRE CWE-305

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-111283 Public exploit

    BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

    BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can subm…

    BMC Helix BMC Helix Network Management
  • Critical 9.8
    CVE-2026-25555 Public exploit

    OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

    OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middl…

    openbullet openbullet2
  • Critical 9.3
    CVE-2026-30849 Public exploit

    MantisBT SOAP API has an authentication bypass vulnerability on MySQL

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password paramete…

    mantisbt mantisbt mantisbt/mantisbt Packagist
  • Critical 9.8
    CVE-2025-31161 Exploited · Ransomware Public exploit EPSS 100%

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unl…

    CrushFTP CrushFTP
    KEV Apr 7, 2025
  • Critical 9.8
    CVE-2021-26102 Public exploit EPSS 20%

    A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remo…

    Fortinet FortiWAN Network devices
  • Critical 9.8
    CVE-2024-50478 Public exploit

    WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability

    Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.

    Swoop 1-Click Login: Passwordless Authentication
  • Critical 10.0
    CVE-2024-1403 Public exploit

    Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

    In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The vulnerability is a bypass to authentication based on a fa…

    Progress OpenEdge
  • Critical 9.8
    CVE-2023-34124 Public exploit EPSS 50%

    The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…

    SonicWall GMS Analytics Network devices
  • Critical 9.8
    CVE-2022-2651 Public exploit EPSS 16%

    Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm

    Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.

    bookwyrm-social bookwyrm-social/bookwyrm