Skip to content
OpenAdvisories

Weakness (CWE)

CWE-636: Not Failing Securely

Class Draft

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Subdivide and allocate resources and components so that a failure in one part does not affect the entire product.

Source: MITRE CWE-636

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.9
    CVE-2026-85649 Public exploit

    (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the …

    chewkeanho software-actualizer
  • Critical 9.8
    CVE-2026-53913 Public exploit

    Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted

    Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.bef…

    Apache Software Foundation Apache Camel Keycloak org.apache.camel:camel-keycloak Maven