CWE-1390: Weak Authentication
Filter
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
What the weakness is: CWE-1390 at MITRE. OWASP Top 10: A07:2025 Authentication Failures
Ask an AI about CWE-1390
Show the prompt
Explain CWE-1390: Weak Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1390.html and https://cve.bz/cve/cwe/1390?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.1CVE-2026-113373
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Rep…
- 8.8CVE-2026-115967EPSS 0.4%
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78.
- 7.1CVE-2025-30414EPSS 0.2%
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
- 9.3CVE-2026-110475EPSS 0.5%
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulatin…
- 7.8CVE-2026-88101EPSS 0.2%
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
- 5.3CVE-2026-85939EPSS 0.4%
Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.
- 7.4CVE-2026-85922EPSS 0.6%
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
- 7.8CVE-2026-85376EPSS 0.3%
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
- 7.0CVE-2026-85328EPSS 0.2%
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
- 6.8CVE-2026-85323EPSS 0.5%
Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.
- 7.8CVE-2026-83840EPSS 0.4%
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- 5.5CVE-2026-83681EPSS 0.3%
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
- 8.1CVE-2026-83674EPSS 0.7%
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- 5.5CVE-2026-83657EPSS 0.3%
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- 7.8CVE-2026-83586EPSS 0.3%
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
- 7.4CVE-2026-83511EPSS 0.7%
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- 5.9CVE-2026-70005EPSS 0.6%
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- 5.9CVE-2026-69982EPSS 0.6%
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- 8.1CVE-2026-69802EPSS 0.6%
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
- 8.8CVE-2026-96940EPSS 2.7%
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- 7.6CVE-2026-93355EPSS 0.3%
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authenticat…
- 9.1CVE-2026-92289EPSS 0.5%
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDat…
- 9.1CVE-2026-92288EPSS 0.4%
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Rely…
- 7.1CVE-2026-94455EPSS 0.3%
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that…
- 8.8CVE-2026-77483EPSS 0.8%
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
- 9.8CVE-2026-73025EPSS 0.9%
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
- 8.8CVE-2026-62895EPSS 0.8%
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- 9.3CVE-2026-73819EPSS 0.5%
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network co…
- 6.3CVE-2026-44476EPSS 0.6%
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an…
- 9.8CVE-2026-65098EPSS 1.0%
NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, an…
- 9.3CVE-2026-68067EPSS 0.5%
The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control c…
- 5.5CVE-2026-59135EPSS 0.4%
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- 7.5CVE-2026-59554EPSS 0.4%
Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.
- 7.5CVE-2026-50756EPSS 0.5%
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component
- 9.1CVE-2026-55040KEVExploitEPSS 70%
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
- 8.8CVE-2026-10714EPSS 0.1%
A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm…
- 4.8CVE-2026-57352EPSS 0.3%
Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.
- 8.1CVE-2026-0274EPSS 0.3%
An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.
- 9.8CVE-2026-6274EPSS 0.5%
Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This i…
- 7.6CVE-2026-44237EPSS 2.7%
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid client_id is required. The validateClient() met…
- 4.1CVE-2026-49323EPSS 0.1%
Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network t…
- 4.1CVE-2026-49322EPSS 0.1%
Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by pass…
- 7.8CVE-2026-40417EPSS 0.3%
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
- 8.0CVE-2026-0204EPSS 0.4%
A vulnerability in the access control mechanism of SonicOS may allow certain management interface functions to be accessible under specific conditions.
- 7.3CVE-2025-70994EPSS 0.3%
Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic ch…
- 9.3CVE-2026-6886EPSS 0.5%
Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user.
- 8.2CVE-2026-4924EPSS 0.3%
Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the…
- 8.2CVE-2026-4828EPSS 0.3%
Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request.
- 5.3CVE-2026-32497EPSS 0.2%
Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45.
- 4.0CVE-2025-62844EPSS 0.2%
A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the follow…