cve.bz

CWE-287: Improper Authentication, page 30

Filter

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

What the weakness is: CWE-287 at MITRE

Ask an AI about CWE-287

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-287: Improper Authentication and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/287.html and https://cve.bz/cve/cwe/287?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.1CVE-2024-50641EPSS 0.4%

    An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token.

  2. 9.8CVE-2025-52395EPSS 0.6%

    An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly

  3. 9.8CVE-2025-50901EPSS 0.4%

    JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.

  4. 9.8CVE-2024-50640EPSS 0.5%

    jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function

  5. 8.8CVE-2024-57491EPSS 0.3%

    Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token via the preHandle function.

  6. 9.8CVE-2025-55293EPSS 0.5%

    Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a new key. First sending a empty key bypasses 'if (p.public_key.size > 0) {', cleari…

  7. 5.5CVE-2025-9100EPSS 0.6%

    A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by c…

  8. 1.9CVE-2025-8964EPSS 0.3%

    A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login. The manipulation leads to improper authentication. It is possible to launch th…

  9. 9.8CVE-2025-51451EPSS 0.4%

    In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

  10. 7.5CVE-2025-55171EPSS 0.7%

    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check authentication at endpoint /html/personalizacao_remover.php allowing anonymous …

  11. 10.0CVE-2025-55169ExploitEPSS 1.7%

    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.ph…

  12. 7.5CVE-2025-53793EPSS 1.4%

    Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.

  13. 8.8CVE-2025-53778EPSS 52%

    Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.

  14. 5.5CVE-2025-8838EPSS 0.6%

    A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argumen…

  15. 8.7CVE-2025-54888EPSS 0.6%

    Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636 through 1.5.4, 1.6.0-dev.754 through 1.6.7, 1.7.0-pr.251.885 through 1.7.8 and …

  16. 5.3CVE-2025-54786EPSS 0.3%

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An …

  17. 8.0CVE-2025-53786EPSS 7.6%

    On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deploy…

  18. 5.5CVE-2025-8546EPSS 0.5%

    A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible …

  19. 5.5CVE-2025-8348EPSS 0.6%

    A vulnerability has been found in Kehua Charging Pile Cloud Platform 1.0 and classified as critical. This vulnerability affects unknown code of the file /home. The manipulation leads to improper authentication. The attack can be initiated …

  20. 6.5CVE-2025-54573EPSS 0.3%

    CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts us…

  21. 8.1CVE-2025-6505EPSS 0.4%

    Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially le…

  22. 10.0CVE-2025-54419EPSS 0.4%

    A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. T…

  23. 9.8CVE-2025-45777EPSS 0.8%

    An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted request.

  24. 5.9CVE-2025-0249EPSS 0.3%

    HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.  A token was not invalidated which may allow attackers to access sensitive data without authorization.

  25. 7.0CVE-2024-12310EPSS 0.2%

    A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allows unauthorized access to the underlying Windows system through the already lo…

  26. 9.8CVE-2025-54452EPSS 0.5%

    Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.

  27. 7.8CVE-2025-41459EPSS 0.2%

    Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN atte…

  28. 9.8CVE-2024-6107EPSS 0.4%

    Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.

  29. 6.5CVE-2025-53771ExploitEPSS 99.8%

    Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

  30. 6.9CVE-2025-7897EPSS 0.7%

    A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this issue is the function verify_token of the file app/controllers/base.py of the component API Endpoint. The manipulation leads …

  31. 5.5CVE-2025-7875EPSS 0.8%

    A vulnerability classified as critical has been found in Metasoft 美特软件 MetaCRM up to 6.4.2. This affects an unknown part of the file /debug.jsp. The manipulation leads to improper authentication. It is possible to initiate the attack remot…

  32. 5.5CVE-2025-7862EPSS 1.2%

    A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation …

  33. 9.8CVE-2025-37107EPSS 0.5%

    An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.

  34. 9.8CVE-2025-37106EPSS 0.5%

    An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.

  35. 7.1CVE-2025-7699EPSS 0.4%

    An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to copy arbitrary files from the server file system into their own EZSync folder. The vulnerability is due to a lack of aut…

  36. 3.1CVE-2025-7703EPSS 0.3%

    Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage.

  37. 9.1CVE-2025-49831EPSS 1.2%

    An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberAr…

  38. 9.8CVE-2025-52376EPSS 14%

    An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an attacker to remotely enable the Telnet service without authentication, bypassin…

  39. 9.4CVE-2025-3621EPSS 0.7%

    Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems.  * vulnerabilities: * Improper Neutralization of Special Elements used in a Command ('Command Inject…

  40. 6.5CVE-2025-53889EPSS 0.5%

    Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.12.0 and prior to version 11.9.0, Directus Flows with a manual trigger are not validating whether the user triggering the Flow has permi…

  41. 7.3CVE-2024-51767EPSS 1.4%

    An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.

  42. 8.9CVE-2025-7574EPSS 0.9%

    A vulnerability, which was classified as critical, was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. Affected is the function reboot/restore of the file /cgi-bin/lighttpd.cgi of t…

  43. 4.6CVE-2025-31267EPSS 0.2%

    An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information.

  44. 7.4CVE-2025-49812EPSS 0.6%

    In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine option…

  45. 6.5CVE-2025-49706KEVExploitEPSS 99.0%

    Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

  46. 6.9CVE-2025-53545EPSS 0.3%

    Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vul…

  47. 9.1CVE-2025-21450EPSS 0.3%

    Cryptographic issue occurs due to use of insecure connection method while downloading.

  48. 6.1CVE-2025-6044EPSS 0.1%

    An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the lock screen and access user files by removing the stylus wh…

  49. 6.9CVE-2025-7115EPSS 0.5%

    A vulnerability was found in rowboatlabs rowboat up to 8096eaf63b5a0732edd8f812bee05b78e214ee97. It has been rated as critical. Affected by this issue is the function PUT of the file apps/rowboat/app/api/uploads/[fileId]/route.ts of the co…

  50. 5.5CVE-2025-7114EPSS 0.6%

    A vulnerability was found in SimStudioAI sim up to 37786d371e17d35e0764e1b5cd519d873d90d97b. It has been declared as critical. Affected by this vulnerability is the function POST of the file apps/sim/app/api/files/upload/route.ts of the co…