Improper Authentication
CWE-287
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
We track 1,836 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 52 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Latest Improper Authentication vulnerabilities
- 9.8 Critical severity
Adobe Framemaker Publishing Server: Improper Authentication
Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default ad
- 9.8 Critical severity
Tor Loco Min: Improper Authentication
An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request to the MQTT component.
- 7.8 High severity
Intel(R) NUC Kits NUC7PJYH and NUC7CJYH…: Improper Authentication
Improper authentication in some Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek* SD Card Reader Driver installation software before version 10.0.19041.29098 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) NUC Kit NUC11PH USB firmware…: Improper Authentication
Improper authentication in some Intel(R) NUC Kit NUC11PH USB firmware installation software before version 1.1 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.
- 8.8 High severity
Intel Unison software: Improper Authentication
Improper authentication for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.
- 9.8 Critical severity
CAS: Improper Authentication
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fix
- 7.1 High severity
Samsung Mobile Devices: Improper Authentication
Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from the background.
- 7.5 High severity
strapi: Improper Authentication
strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has bee
- 7.8 High severity
OX App Suite: Improper Authentication
RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. RMI access is restricted to localhost by default. The interfa
- 7.5 High severity
NPort 6000 Series: Improper Authentication
A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implementation of sensitive information protection, potentially allowing malicious users to gain unauthorized
- 9.8 Critical severity
authentik: Missing Authentication for Critical Functionality
authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admin user has been deleted, it is potentially possible for an attacker to set the password of the default admin user without any authentication. authenti
- 9.8 Critical severity
CloudExplorer-Lite: Improper Authentication
CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller with path starting with `matching/API/`, which can cause a permission bypass. Version 1.4.1 contains
- 9.8 Critical severity
Document Locator: Improper Authentication
A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It i
- 8.8 High severity
Access Controller: Improper Authentication
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only B
- 8.1 High severity
FactoryTalk® Services Platform: Improper Authentication
Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Services Platform web service and then use the token to log in into FactoryTalk® Services Platform . This vu
- 7.5 High severity
com.palantir.meta:orbital-simulator: Improper Limitation of a Pathname to a Restricted Directory
Gotham Orbital-Simulator service prior to 0.692.0 was found to be vulnerable to a Path traversal issue allowing an unauthenticated user to read arbitrary files on the file system.
- 7.5 High severity
IDWeb: Improper Authentication
Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student data by unauthenticated attackers.
- 8.8 High severity
FX0-GMOD00000: Improper Authentication
Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially im
- 8.8 High severity
DexGate: Improper Authentication
The affected product is vulnerable to an improper authentication vulnerability, which may allow an attacker to impersonate a legitimate user as long as the device keeps the session active, since the attack takes advantage of the cookie header to generate "legi
- 9.1 Critical severity
MELSEC-F Series FX3U-16MT/ES: Improper Authentication
Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequence programs from the product or write malicious sequence programs or improper data in the product wit
- 7.8 High severity
privileged_remote_access: Improper Authentication
BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by gues
- 9.8 Critical severity
YF325: Improper Authentication
An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
- 7.5 High severity
HarmonyOS: Improper Restriction of Excessive Authentication Attempts
Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
soft-serve: Improper Authentication
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is ac
- 7.5 High severity
nexkey: Improper Authentication
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issu
- 7.5 High severity
misskey: Improper Authentication
Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. The
- 7.5 High severity
asyncua: Improper Authentication
Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. **Note:** This issue is a result of missing checks for services that require an acti
- 8.8 High severity
ACERA 1320: Improper Authentication
Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log fi
- 7.5 High severity
DataCube4: Improper Authentication
A vulnerability classified as problematic was found in Field Logic DataCube4 up to 20231001. This vulnerability affects unknown code of the file /api/ of the component Web API. The manipulation leads to improper authentication. The exploit has been disclosed t
- 8.8 High severity
CL4NX-J Plus: Improper Authentication
A vulnerability classified as critical has been found in SATO CL4NX-J Plus 1.13.2-u455_r2. This affects an unknown part of the component Cookie Handler. The manipulation with the input auth=user,level1,settings; web=true leads to improper authentication. Acces
- 8.8 High severity
CL4NX-J Plus: Improper Authentication
A vulnerability was found in SATO CL4NX-J Plus 1.13.2-u455_r2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component WebConfig. The manipulation leads to improper authentication. The attack needs to be do
- 8.1 High severity
warpgate: Improper Verification of Cryptographic Signature
Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. The SSH key verification for a user can be bypassed by sending an SSH key offer without a signature. This allows bypassing authentication under following con
- 9.8 Critical severity
jumpserver: Improper Restriction of Excessive Authentication Attempts
JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to at
- 9.8 Critical severity
Cisco SD-WAN vManage: Improper Authentication
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to im
- 9.1 Critical severity
Acronis Cyber Protect 15: Improper Authentication
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.
- 7.8 High severity
DGX H100 BMC: Improper Authentication
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vulnerability may lead to escalation of privileges, information disclosure, code execution, and denial o
- 8.2 High severity
Arconte Áurea: Improper Authentication
ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circu
- 9.8 Critical severity
Uniview IP Camera IPC322LB-SF28-A: Improper Authentication
The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Succes
- 7.5 High severity
NETWORK-OBSERVABILITY-1.1.0-RHEL-8: Improper Authentication
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster
- 7.5 High severity
vtech_nb403-il: Improper Authentication
An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.13T, and BZ_2.02.07.09.09T, allows remote attackers to gain sensitive information via rootDesc.xml page of the UPnP serv