CWE-303 Incorrect Implementation of Authentication Algorithm
baseThe requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (132)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-7593US | critical9.8OT kritisch | KEV | ||
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the… | ||||
| CVE-2023-29357US | —OT kritisch | KEV | ||
Microsoft SharePoint Server Elevation of Privilege Vulnerability | ||||
| CVE-2020-8863US | high8.8 | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authe… | ||||
| CVE-2025-13390US | critical9.8 | Exploit | ||
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication a… | ||||
| CVE-2022-20695US | critical10.0 | — | ||
A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication control… | ||||
| CVE-2024-26594US | high7.1 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate mech token in session setup
If client send invalid mech token in session setup request, ksmbd… | ||||
| CVE-2018-4841US | critical9.8 | — | ||
A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform administrative operati… | ||||
| CVE-2024-4985US | critical9.8 | — | ||
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions f… | ||||
| CVE-2021-32691US | critical9.8 | — | ||
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by o… | ||||
| CVE-2026-12773US | critical9.8 | — | ||
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mc… | ||||
| CVE-2026-46389US | critical9.8 | — | ||
UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0,… | ||||
| CVE-2026-35579US | critical9.8 | — | ||
CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUI… | ||||
| CVE-2026-29515US | critical9.8OT erhöht | — | ||
MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials. A… | ||||
| CVE-2026-28446US | critical9.8 | — | ||
OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy validation that a… | ||||
| CVE-2025-66489US | critical9.8 | — | ||
Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided… | ||||
| CVE-2024-10127US | critical9.8 | — | ||
Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a… | ||||
| CVE-2023-3326US | critical9.8 | — | ||
pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the networ… | ||||
| CVE-2023-29129US | critical9.8 | — | ||
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3),… | ||||
| CVE-2022-39366US | critical9.8 | — | ||
DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens.… | ||||
| CVE-2022-20923US | critical9.8 | — | ||
A vulnerability in the IPSec VPN Server authentication functionality of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attack… | ||||
04
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan