Weakness (CWE)
CWE-305: Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Source: MITRE CWE-305
5 results · Clear filters · Feed
-
Low 3.1
OAuth authorization code client binding not enforced during token redemption in Mattermost
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a c…
-
Low 2.4
A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may …
-
Low 3.1
On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.
-
Low 3.1
File Browser's Password Protection of Links Vulnerable to Bypass
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potent…
-
Low 2.0
i-Drive i11/i12 Device Pairing authentication bypass
A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device Pairing. The manipulation leads to authentication bypass by primary weakness. It is possible to lau…