Key Exchange without Entity Authentication
CWE-322
The product performs a key exchange with an actor without verifying the identity of that actor.
We track 17 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
How this weakness is prevented
- Architecture and Design: Ensure that proper authentication is included in the system design.
- Implementation: Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
Latest Key Exchange without Entity Authentication vulnerabilities
- 9.1 Critical severity
Apache Airflow SSH provider: Key Exchange without Entity Authentication
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An
- 9.3 Critical severity
OTP: Key Exchange without Entity Authentication
Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client
- 8.1 High severity
Apache Airflow Git provider: Key Exchange without Entity Authentication
The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the se
- 8.8 High severity
Central Dogma: Key Exchange without Entity Authentication
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and c
- 8.1 High severity
Apache Airflow Google provider: Key Exchange without Entity Authentication
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advis
- 8.1 High severity
Apstra: Key Exchange without Entity Authentication
A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machin
- 9.8 Critical severity
Red Hat Enterprise Linux 10: Key Exchange without Entity Authentication
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform adminis
- 8.1 High severity
Archer AX53 v1.0: Key Exchange without Entity Authentication
SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credent
- 8.7 High severity
Cisco Data Center Network Manager: Key Exchange without Entity Authentication
A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacke
- 7.1 High severity
Fabric OS: Missing Authentication for Critical Functionality
A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle attackers to conduct remote Service Session Hijacking that may arise from the attacker's ability to forge an SSH key while the Brocade Fabric OS Switch is performing vario
- 7.5 High severity
matrix-rust-sdk: Improper Authentication
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prior to version 0.6, when a user requests a room key from their devices, the software correctly remembers the request. When
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-
- 7.5 High severity
matrix-ios-sdk: Improper Authentication
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey
- 7.5 High severity
matrix-ios-sdk: Improper Authentication
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication su
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as
- 7.5 High severity
matrix-js-sdk: Improper Authentication
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shiel
- 7.5 High severity
matrix-android-sdk2: Improper Authentication
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Addit