Authentication Bypass by Primary Weakness
CWE-305
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
We track 89 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 3 have been exploited in real attacks.
Latest Authentication Bypass by Primary Weakness vulnerabilities
- 8.8 High severity
Maverick Synergy Server: Authentication Bypass by Primary Weakness
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. At
- 9.3 Critical severity
FortiOS: Authentication Bypass by Primary Weakness
A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially craf
- 8.1 High severity
Red Hat build of Keycloak 26.6: Authentication Bypass by Primary Weakness
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belo
- 9.8 Critical severity
Apache Qpid Proton C: Authentication Bypass by Primary Weakness
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this
- 9.0 Critical severity
BMC Helix Network Management: Authentication Bypass by Primary Weakness
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submi
- 8.1 High severity
nginx-ui: Improper Authentication
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore iss
- 9.1 Critical severity
Gitea: Authentication Bypass by Primary Weakness
When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can
- 9.1 Critical severity
Apache MINA SSHD: Improper Neutralization of Special Elements used in an LDAP Query
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for
- 9.1 Critical severity
Apache MINA SSHD: Authentication Bypass by Primary Weakness
Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server. Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the
- 9.1 Critical severity
ash_authentication: Authentication Bypass by Primary Weakness
Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. AshAuthentication.Strategy.Password.Actions.check_user/2 decides whe
- 9.8 Critical severity
PaperCut NG/MF Missing Authentication for Critical Function Exploited
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of
- 7.4 High severity
Apache Hive: Improper Authentication
An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network
- 9.3 Critical severity
vsDesk: Authentication Bypass by Primary Weakness
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provi
- 7.6 High severity
WiseConnect: Authentication Bypass by Primary Weakness
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below.
- 8.8 High severity
WiseConnect: Authentication Bypass by Primary Weakness
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
- 8.8 High severity
Xen: Improper Access Control
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these op
- 7.5 High severity
curl: Authentication Bypass by Primary Weakness
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them ma
- 9.0 Critical severity
Control-M/Server: Authentication Bypass by Primary Weakness
A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to co
- 8.8 High severity
Rancher: Authentication Bypass by Primary Weakness
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
- 8.7 High severity
SafeLine SL6/SL6+: Authentication Bypass by Primary Weakness
The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication requirements and access the device's configuration service via the Bl
- 9.8 Critical severity
openbullet2: Authentication Bypass by Primary Weakness
OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middle
- 7.6 High severity
Server: Authentication Bypass by Primary Weakness
Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors.
- 7.8 High severity
Container suse/sle-micro-rancher/5.3:latest: Authentication Bypass by Primary Weakness
In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASC
- 8.6 High severity
mlflow/mlflow: Authentication Bypass by Primary Weakness
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middlewar
- 8.3 High severity
Red Hat Ansible Automation Platform 2.5 for…: Authentication Bypass by Primary Weakness
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a r
- 9.8 Critical severity
MOVEit Automation: Authentication Bypass by Primary Weakness
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
- 9.1 Critical severity
Spring Boot: Missing Authorization
In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and re
- 9.1 Critical severity
CRM: Authentication Bypass Using an Alternate Path or Channel
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user's API key, bypassing the normal authentication flow that enforces account l
- 7.1 High severity
Industrial Edge Management Pro V1: Authentication Bypass by Primary Weakness
A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >= V1.7.6 < V1.15.17), Industrial Edge Management Pro V2 (All versions >= V2.0.0 < V2.1.1), Industrial Edge Management Virtual (All versions >= V2.2.0 < V2.8.0). Affected ma
- 8.1 High severity
oathkeeper: Authentication Bypass by Primary Weakness
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The `oauth2_introspecti
- 9.8 Critical severity
mantisbt: Authentication Bypass by Primary Weakness
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter
- 8.1 High severity
apostrophe: Improper Authentication
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — whe
- 8.8 High severity
Red Hat build of Keycloak 26.2: Authentication Bypass by Primary Weakness
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (
- 8.1 High severity
HarmonyOS: Authentication Bypass by Primary Weakness
Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
- 8.8 High severity
ASCG: Authentication Bypass by Primary Weakness
Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming configuration. and could even disable the ASCG application or disable use of BSL data collection on Broca
- 8.1 High severity
FortiOS: Authentication Bypass by Primary Weakness
An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is confi
- 7.2 High severity
Fabric OS: Authentication Bypass by Primary Weakness
A vulnerability in the secure configuration of authentication and management services in Brocade Fabric OS before Fabric OS 9.2.1c2 could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands as root using “suppo
- 10.0 Critical severity
Sufirmam: Authentication Bypass by Primary Weakness
Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation. This issue affects Sufirmam
- 9.8 Critical severity
API Connect: Authentication Bypass by Primary Weakness
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
- 9.1 Critical severity
com.palantir.gotham:glutton: Authentication Bypass by Primary Weakness
Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit glutton backend directly and read/update/delete data. The affected service has been patched and automat