CWE-287— Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.— MITRE CWE catalog

5,883 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-287page 30 of 118

CVE-2019-9564CRITICALCVSS 7.5EG 9.8
2022-03-30
A vulnerability in the authentication logic of Wyze Cam Pan v2, Cam v2, Cam v3 allows an attacker to bypass login and control the devices. This issue affects: Wyze Cam Pan v2 versions prior to 4.49.1.47. Wyze Cam v2 versions prior to 4.9.8…
CVE-2021-28503CRITICALCVSS 7.4EG 9.8
2022-02-04
The impact of this vulnerability is that Arista's EOS eAPI may skip re-evaluating user credentials when certificate based authentication is used, which allows remote attackers to access the device via eAPI.
CVE-2026-2991CRITICALCVSS 7.3EG 9.8
2026-03-18
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social …
CVE-2023-1464CRITICALCVSS 7.3EG 9.8
2023-03-17
A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?f=save_user. The manipulation of the argument firstname/middlename/lastname/user…
CVE-2022-1101CRITICALCVSS 7.3EG 9.8
2023-01-07
A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /royal_event/userregister.php. The manipulation leads to improper authent…
CVE-2014-125060CRITICALCVSS 7.3EG 9.8
2023-01-07
A vulnerability, which was classified as critical, was found in holdennb CollabCal. Affected is the function handleGet of the file calenderServer.cpp. The manipulation leads to improper authentication. It is possible to launch the attack r…
CVE-2022-3674CRITICALCVSS 7.3EG 9.8
2022-10-26
A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be…
CVE-2022-3465CRITICALCVSS 7.3EG 9.8
2022-10-12
A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit…
CVE-2022-2664CRITICALCVSS 7.3EG 9.8
2022-08-05
A vulnerability classified as critical has been found in Private Cloud Management Platform. Affected is an unknown function of the file /management/api/rcx_management/global_config_query of the component POST Request Handler. The manipulat…
CVE-2017-20133CRITICALCVSS 7.3EG 9.8
2022-07-16
A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation leads to improper authentication. It is possible to initiate the attack remotel…
CVE-2021-26638CRITICALCVSS 7.3EG 9.8
2022-06-23
Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can use this vulerability to take control of the home environment including indoor con…
CVE-2022-1084CRITICALCVSS 7.3EG 9.8
2022-03-29
A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /one_church/userregister.php. The manipulation leads to authenticat…
CVE-2021-43355CRITICALCVSS 7.3EG 9.8
2022-01-21
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users…
CVE-2021-23196CRITICALCVSS 7.3EG 9.8
2022-01-21
The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently.
CVE-2021-35964CRITICALCVSS 7.3EG 9.8
2021-07-19
The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the…
CVE-2023-42531CRITICALCVSS 7.1EG 9.8
2023-11-07
Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from the background.
CVE-2021-40342CRITICALCVSS 7.1EG 9.8
2023-01-05
In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected…
CVE-2021-44057CRITICALCVSS 7.1EG 9.8
2022-05-05
An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in…
CVE-2021-44056CRITICALCVSS 7.1EG 9.8
2022-05-05
An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in…
CVE-2022-26870CRITICALCVSS 7.0EG 9.8
2022-10-21
Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability under specific configuration. An attacker would gain unauthorized access upon s…
CVE-2022-22796CRITICALCVSS 7.0EG 9.8
2022-05-12
Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authent…
CVE-2021-45511CRITICALCVSS 6.8EG 9.8
2021-12-26
Certain NETGEAR devices are affected by authentication bypass. This affects AC2100 before 2021-08-27, AC2400 before 2021-08-27, AC2600 before 2021-08-27, D7000 before 2021-08-27, R6220 before 2021-08-27, R6230 before 2021-08-27, R6260 befo…
CVE-2023-1460CRITICALCVSS 6.5EG 9.8
2023-03-17
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipu…
CVE-2013-10004CRITICALCVSS 6.5EG 9.8
2022-05-24
A vulnerability classified as critical was found in Telecommunication Software SAMwin Contact Center Suite 5.1. This vulnerability affects the function passwordScramble in the library SAMwinLIBVB.dll of the component Password Handler. Inco…
CVE-2021-3652CRITICALCVSS 6.5EG 9.8
2022-04-18
A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to…
CVE-2021-40404CRITICALCVSS 6.5EG 9.8
2022-01-28
An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to authentication bypass. An attacker can send an HTTP request to tri…
CVE-2021-45498CRITICALCVSS 6.5EG 9.8
2021-12-26
NETGEAR R6700v2 devices before 1.2.0.88 are affected by authentication bypass.
CVE-2021-45495CRITICALCVSS 6.5EG 9.8
2021-12-26
NETGEAR D7000 devices before 1.0.1.68 are affected by authentication bypass.
CVE-2022-41545CRITICALCVSS 6.4EG 9.8
2025-02-18
The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication, with an HTTP header containing a base64 value of the plaintext username and pas…
CVE-2015-10083CRITICALCVSS 6.3EG 9.8
2023-02-21
A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper aut…
CVE-2022-2765CRITICALCVSS 6.3EG 9.8
2022-08-11
A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/settings. The manipulation leads to improper authentic…
CVE-2023-27536CRITICALCVSS 5.9EG 9.8
2023-03-30
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DEL…
CVE-2022-34839CRITICALCVSS 5.9EG 9.8
2022-07-22
Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.
CVE-2022-34767CRITICALCVSS 5.9EG 9.8
2022-07-21
Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing the http[s]://wizardpwd.asp/cgi-bin. Does not validate the user's identity and …
CVE-2022-30623CRITICALCVSS 5.9EG 9.8
2022-07-18
The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password.
CVE-2021-36308CRITICALCVSS 5.9EG 9.8
2021-11-20
Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to gain access and perform actions on t…
CVE-2025-32875CRITICALCVSS 5.7EG 9.8
2025-06-20
An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application itself. Also, the watch does not enforce pairing and bonding. As a result, any …
CVE-2022-34331CRITICALCVSS 5.5EG 9.8
2022-11-11
After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configuration being disabled. IBM X-Force ID: 229695.
CVE-2017-9285CRITICALCVSS 5.4EG 9.8
2018-03-02
NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory services.
CVE-2023-1784CRITICALCVSS 5.3EG 9.8
2023-03-31
A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. This issue affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication. The attack may be initiated remotel…
CVE-2022-20733CRITICALCVSS 5.3EG 9.8
2022-06-15
A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sen…
CVE-2021-1472CRITICALCVSS 5.3EG 9.8
2021-04-08
Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. A remote attacker could execute arbitrary commands or bypass authentication and upload files on an affected device. For more in…
CVE-2023-21467CRITICALCVSS 4.6EG 9.8
2025-09-03
Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted message.
CVE-2022-35726CRITICALCVSS 4.3EG 9.8
2022-08-23
Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.
CVE-2022-20923CRITICALCVSS 4.0EG 9.8
2022-09-08
A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to bypass authentication controls and access the IPSec V…
CVE-2020-36533CRITICALCVSS 3.7EG 9.8
2022-06-07
A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely.
CVE-2022-39892CRITICALCVSS 3.6EG 9.8
2022-11-09
Improper access control in Samsung Pass prior to version 4.0.05.1 allows attackers to unauthenticated access via keep open feature.
CVE-2023-28473CRITICALCVSS 3.3EG 9.8
2023-04-28
Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs section.
CVE-2026-79870CRITICALCVSS 9.6EG 9.6
2026-10-22
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative ac…
CVE-2026-79869CRITICALCVSS 9.6EG 9.6
2026-10-22
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary…

Map vulnerabilities like CWE-287 to your infrastructure

EchelonGraph correlates every CVE — across CWE-287 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →