Skip to content
OpenAdvisories

Weakness (CWE)

CWE-305: Authentication Bypass by Primary Weakness

Base Draft

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Source: MITRE CWE-305

All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-111283 Public exploit

    BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

    BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can subm…

    BMC Helix BMC Helix Network Management
  • High 8.8
    CVE-2026-81578 Exploited Public exploit EPSS 85%

    PaperCut MF/NG: Authentication Bypass

    An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion o…

    PaperCut PaperCut MF/NG
    KEV Aug 31, 2026
  • High 7.5
    CVE-2026-8932 Public exploit

    incomplete mTLS config matching in conn reuse

    libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them m…

    curl curl curl curl Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2026-25555 Public exploit

    OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

    OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middl…

    openbullet openbullet2
  • Critical 9.3
    CVE-2026-30849 Public exploit

    MantisBT SOAP API has an authentication bypass vulnerability on MySQL

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password paramete…

    mantisbt mantisbt mantisbt/mantisbt Packagist
  • High 7.3
    CVE-2025-56132 Public exploit

    LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The appl…

  • High 8.2
    CVE-2025-41450 Public exploit

    Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2

    Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2

    Danfoss AK-SM 8xxA Series
  • Critical 9.8
    CVE-2025-31161 Exploited · Ransomware Public exploit EPSS 100%

    CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unl…

    CrushFTP CrushFTP
    KEV Apr 7, 2025
  • Critical 9.8
    CVE-2021-26102 Public exploit EPSS 20%

    A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remo…

    Fortinet FortiWAN Network devices
  • Critical 9.8
    CVE-2024-50478 Public exploit

    WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability

    Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.

    Swoop 1-Click Login: Passwordless Authentication
  • Medium 6.8
    CVE-2024-37085 Exploited · Ransomware Public exploit EPSS 27%

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…

    Virtualization
    KEV Jul 30, 2024
  • Critical 10.0
    CVE-2024-1403 Public exploit

    Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

    In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The vulnerability is a bypass to authentication based on a fa…

    Progress OpenEdge
  • High 8.8
    CVE-2024-20674 Public exploit EPSS 17%

    Windows Kerberos Security Feature Bypass Vulnerability

    Windows Kerberos Security Feature Bypass Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Critical 9.8
    CVE-2023-34124 Public exploit EPSS 50%

    The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…

    SonicWall GMS Analytics Network devices
  • High 8.6
    CVE-2023-0777 Public exploit EPSS 15%

    Authentication Bypass by Primary Weakness in modoboa/modoboa

    Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4.

    modoboa modoboa/modoboa modoboa PyPI
  • Critical 9.8
    CVE-2022-2651 Public exploit EPSS 16%

    Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm

    Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.

    bookwyrm-social bookwyrm-social/bookwyrm
  • Medium 6.5
    CVE-2020-10923 Public exploit EPSS 85%

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R670…

    NETGEAR R6700 Network devices