CWE-1390: Weak Authentication, page 2
Filter
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
What the weakness is: CWE-1390 at MITRE. OWASP Top 10: A07:2025 Authentication Failures
Ask an AI about CWE-1390
Show the prompt
Explain CWE-1390: Weak Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1390.html and https://cve.bz/cve/cwe/1390?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.1CVE-2026-27478EPSS 0.2%
Unity Catalog is an open, multi-modal Catalog for data and AI. In 0.4.0 and earlier, a critical authentication bypass vulnerability exists in the Unity Catalog token exchange endpoint (/api/1.0/unity-control/auth/tokens). The endpoint extr…
- 9.8CVE-2026-28710EPSS 0.5%
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
- 5.7CVE-2025-15595EPSS 0.1%
Privilege escalation via dll hijacking in Inno Setup 6.2.1 and ealier versions.
- 5.3CVE-2026-1693EPSS 0.4%
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being depreca…
- 10.0CVE-2025-30412EPSS 0.7%
Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
- 10.0CVE-2025-30411EPSS 0.8%
Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
- 1.3CVE-2025-57713EPSS 0.6%
A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: File …
- 9.8CVE-2025-40554ExploitEPSS 61%
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
- 9.8CVE-2025-40552ExploitEPSS 52%
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
- 9.3CVE-2023-53894EPSS 0.6%
phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass au…
- 9.8CVE-2025-63807EPSS 0.5%
An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perf…
- 9.3CVE-2025-12871EPSS 0.6%
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them to access the system with elevated privileges.
- 9.3CVE-2025-12870EPSS 0.7%
The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator access tokens and use them to access the system with elevated privileges.
- 7.6CVE-2025-11084EPSS 0.2%
A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not complet…
- 8.8CVE-2025-59249EPSS 0.8%
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- 9.8CVE-2025-49201EPSS 0.6%
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.…
- 6.5CVE-2025-30468EPSS 0.4%
This issue was addressed through improved state management. This issue is fixed in iOS 26 and iPadOS 26. Private Browsing tabs may be accessed without authentication.
- 7.8CVE-2025-50173EPSS 0.5%
Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally.
- 8.8CVE-2025-47995EPSS 0.8%
Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
- 7.2CVE-2025-1727EPSS 0.6%
The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and is…
- 7.0CVE-2025-7326EPSS 0.7%
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future …
- 9.8CVE-2025-47479EPSS 0.4%
Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30.
- 7.6CVE-2025-5484EPSS 0.5%
A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devic…
- 4.8CVE-2024-32119EPSS 0.3%
An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploadi…
- 4.3CVE-2025-0605EPSS 0.3%
An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
- 6.5CVE-2025-32885EPSS 0.2%
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio. This can be …
- 9.8CVE-2025-39596EPSS 0.6%
Weak Authentication vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows Privilege Escalation.This issue affects Quentn WP: from n/a through <= 1.2.8.
- 8.8CVE-2025-27740EPSS 3.5%
Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network.
- 6.5CVE-2025-26635EPSS 1.5%
Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.
- 9.3CVE-2024-54092EPSS 0.8%
A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - …
- 6.2CVE-2024-45551EPSS 0.1%
Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
- 2.2CVE-2025-29991EPSS 0.1%
Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, result…
- 8.8CVE-2025-31676EPSS 0.6%
Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
- 8.2CVE-2025-29994EPSS 0.4%
This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipulating API input para…
- 7.0CVE-2025-24070EPSS 1.0%
Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
- 8.2CVE-2025-1293EPSS 0.3%
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
- 8.2CVE-2024-52541EPSS 0.2%
Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- 9.8CVE-2025-1387EPSS 0.6%
Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.
- 8.1CVE-2025-26343EPSS 0.9%
A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.
- 8.1CVE-2025-23058EPSS 0.7%
A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restri…
- 6.5CVE-2025-21552EPSS 0.4%
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows low priv…
- 9.8CVE-2024-50563EPSS 0.6%
A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiM…
- 9.8CVE-2024-48886EPSS 0.5%
A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0…
- 9.8CVE-2024-13239EPSS 0.6%
Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.
- 7.5CVE-2024-47397EPSS 0.4%
Weak authentication issue exists in AE1021 firmware versions 2.0.10 and earlier and AE1021PE firmware versions 2.0.10 and earlier. If this vulnerability is exploited, the authentication may be bypassed with an undocumented specific string.
- 5.3CVE-2023-41862EPSS 0.7%
Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0.
- 7.8CVE-2024-49019EPSS 2.0%
Active Directory Certificate Services Elevation of Privilege Vulnerability
- 9.3CVE-2024-45367EPSS 0.5%
The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.
- 6.0CVE-2024-47127EPSS 0.1%
In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the d…
- 6.0CVE-2024-41722EPSS 0.1%
In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited …