Weakness (CWE)
CWE-603: Use of Client-Side Authentication
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
How to prevent it (1 mitigation)
-
Architecture and Design
Do not rely on client side data. Always perform server side authentication.
Source: MITRE CWE-603
13 results · Clear filters · Feed
-
High 8.6
Use of Client-Side Authentication in Płatnik
Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 334 in version 10.…
-
High 8.2
OTP Code Exposure in Hayat Hospital's Hayat Mobile
Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.
-
High 7.1
Skype for Business Spoofing Vulnerability
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
-
High 7.5
Ebyte NE2-D11 Use of Client-Side Authentication
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.
-
High 8.7
Authorization Bypass in Sparx Enterprise Architect
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g. using a debugger) and log in as any other user or adminis…
-
High 8.4
Use of Client-Side Authentication in multiple BinSoft products
Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary…
-
High 8.3
Mirion Medical EC2 Software NMIS BioDose Use of Client-Side Authentication
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connec…
-
High 8.3
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication fo…
-
High 7.5
Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exp…
-
High 7.5
MUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability is exploited, other us…
-
High 7.5
An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file.
-
High 7.3
Fresenius Kabi Agilia Connect Infusion System use of client side authentication
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support o…
-
High 7.5
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Con…