Weakness (CWE)
CWE-603: Use of Client-Side Authentication
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
How to prevent it (1 mitigation)
-
Architecture and Design
Do not rely on client side data. Always perform server side authentication.
Source: MITRE CWE-603
6 results · Clear filters · Feed
-
Critical 9.8
Ebyte NA111-M Use of Client-Side Authentication
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.
-
Critical 9.0
Session generation possible with certificate number only
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alon…
-
Critical 9.8
JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security
IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrator privileges by manipulating the web front-end.
-
Critical 9.3
Nuvation Energy BMS Client-side Authentication
A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9.
-
Critical 9.8
CyberTutor｜New Site Server - Use of Client-Side Authentication
New Site Server developed by CyberTutor has a Use of Client-Side Authentication vulnerability, allowing unauthenticated remote attackers to modify the frontend code to gain administrator privileges on the website.
-
Critical 9.3
Use of Client-Side Authentication in TELSAT marKoni FM Transmitter
TELSAT marKoni FM Transmitters are vulnerable to an attacker bypassing authentication and gaining administrator privileges.