CWE-289 Authentication Bypass by Alternate Name
baseThe product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (56)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-56511US | critical9.8 | — | ||
DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be b… | ||||
| CVE-2025-55130US | critical9.1 | Exploit | ||
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories… | ||||
| CVE-2021-34746US | critical9.8 | — | ||
A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, re… | ||||
| CVE-2026-53622US | critical10.0OT elevated | — | ||
Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selectio… | ||||
| CVE-2026-39858US | critical10.0OT elevated | — | ||
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's For… | ||||
| CVE-2026-15980US | critical9.8 | — | ||
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJA… | ||||
| CVE-2026-47280US | critical9.8 | — | ||
Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-24058US | critical9.8 | — | ||
Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate… | ||||
| CVE-2026-50627US | critical9.1 | — | ||
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be… | ||||
| CVE-2023-20046US | high8.8 | — | ||
A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.
T… | ||||
| CVE-2017-16590US | high8.8 | — | ||
This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is requir… | ||||
| CVE-2022-27645US | high8.8OT elevated | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this v… | ||||
| CVE-2022-27642US | high8.8OT elevated | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required… | ||||
| CVE-2026-32036US | high8.2 | — | ||
OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/c… | ||||
| CVE-2023-38487US | high8.2 | — | ||
HedgeDoc is software for creating real-time collaborative markdown notes. Prior to version 1.9.9, the API of HedgeDoc 1 can be used to create notes with an alias matching the ID of… | ||||
| CVE-2023-41890US | high7.5OT elevated | — | ||
Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider.
Prior to versions 1.0.3 and 2.9.2, when a response is… | ||||
| CVE-2023-3263US | high7.5 | — | ||
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when p… | ||||
| CVE-2021-30640US | medium6.5 | — | ||
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the… | ||||
| CVE-2026-48618US | medium6.5 | — | ||
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname… | ||||
| CVE-2026-92579US | medium5.4 | — | ||
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filen… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan