CWE-303: Incorrect Implementation of Authentication Algorithm, page 3
Filter
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
What the weakness is: CWE-303 at MITRE. OWASP Top 10: A07:2025 Authentication Failures
Related attack patterns (CAPEC): 1
- CAPEC-90 Reflection Attack in Authentication Protocol Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-303, as MITRE names them. Credits.
Ask an AI about CWE-303
Show the prompt
Explain CWE-303: Incorrect Implementation of Authentication Algorithm and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/303.html and https://cve.bz/cve/cwe/303?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2023-29129EPSS 0.9%
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 …
- 7.5CVE-2022-41985EPSS 1.5%
An authentication bypass vulnerability exists in the Authentication functionality of Weston Embedded uC-FTPs v 1.98.00. A specially crafted set of network packets can lead to authentication bypass and denial of service. An attacker can sen…
- 6.5CVE-2022-43635EPSS 0.6%
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) routers. Authentication is not required to exploit this vulnerability. The specific f…
- 7.5CVE-2023-25957EPSS 0.6%
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix 9 latest compatible, New Track) (All ver…
- 4.9CVE-2022-4861EPSS 0.6%
Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.
- 8.8CVE-2022-46146EPSS 1.3%
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in au…
- 9.8CVE-2022-39366EPSS 1.1%
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as…
- 9.8CVE-2022-20923EPSS 1.0%
A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to bypass authentication controls and access the IPSec V…
- 7.5CVE-2022-33736EPSS 1.3%
A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affected applications do not properly validate login information during authenticati…
- 10.0CVE-2022-20695EPSS 20%
A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface…
- 8.1CVE-2021-21902EPSS 1.8%
An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection can lead to authentication bypass via session hijacking. An at…
- 9.8CVE-2021-32691EPSS 1.5%
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday…
- 8.2CVE-2021-21378EPSS 1.7%
Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication fil…
- 8.8CVE-2020-15632EPSS 3.5%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the pr…
- 7.3CVE-2020-5268EPSS 1.1%
In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a …
- 8.8CVE-2020-8863EPSS 78%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. Th…
- 8.8CVE-2020-8861EPSS 6.5%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw …
- 9.8CVE-2018-4841EPSS 4.7%
A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform administrative operations on the device without prior authentication. Successful …
- 8.1CVE-2016-9463EPSS 4.1%
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allo…