Weakness (CWE)
CWE-592: DEPRECATED: Authentication Bypass Issues
This weakness has been deprecated because it covered redundant concepts already described in CWE-287.
Source: MITRE CWE-592
24 results · Feed
-
Critical 9.8CVE-2026-43512 Public exploit
Apache Tomcat: Digest authenticator will authenticate any unknown user
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from…
-
Medium 6.8
Gaia unauthenticated endpoints
Gotham Gaia application was found to be exposing multiple unauthenticated endpoints.
-
Medium 6.3
An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplent…
-
High 7.8
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allow…
-
High 7.5
A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. Th…
-
Critical 9.3
Keycloak Authentication Error
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
-
Critical 9.3
Keycloak Authentication Error
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
-
High 8.1
Improper Verification of Cryptographic Signature in keycloak
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attac…
-
Medium 6.5
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were sea…
-
High 7.3
It was found that default configuration of Heketi does not require any authentication potentially exposing the manageme…
-
Unscored —
Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 is re…
-
Critical 9.1
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client cou…
-
Critical 9.8
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
-
Low 3.7
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons …
-
Medium 4.2
prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtu…
-
High 8.5
Jenkins Pipeline Classpath Step plugin allowed Script Security sandbox bypass
It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commit access, as well as users with e.g. Job/Configure permission in Jenkins.
-
Medium 4.1
A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If a…
-
Medium 5.9
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the p…
-
Critical 9.0
openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certifica…
-
Unscored —
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism …
-
High 7.0
Privilege Escalation in Hibernate Validator
In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…
-
Unscored —
Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physi…
-
High 7.5
Advantech WebAccess Authentication Bypass Issues
The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call.
-
High 7.5
I-GEN opLYNX Central Authentication Bypass
The Central application in i-GEN opLYNX before 2.01.9 allows remote attackers to bypass authentication via vectors involving the disabling of browser JavaScript support.