CWE-302 Authentication Bypass by Assumed-Immutable Data
baseThe authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (52)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-9482US | critical9.8 | — | ||
Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.… | ||||
| CVE-2025-29813US | critical9.8 | — | ||
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2024-4024US | high8.8 | — | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.… | ||||
| CVE-2018-1000875US | critical9.8 | — | ||
Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability… | ||||
| CVE-2023-4612US | critical9.8 | — | ||
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS… | ||||
| CVE-2023-4669US | critical9.8 | — | ||
Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass.
This issue affects SYSGuard 3001: before 3.2.20.0. | ||||
| CVE-2026-39429US | critical9.1OT elevated | — | ||
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by… | ||||
| CVE-2024-49056US | high8.8 | — | ||
Authentication bypass by assumed-immutable data on airlift.microsoft.com allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2022-22729US | high8.8 | — | ||
CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets… | ||||
| CVE-2022-3875US | high7.5 | — | ||
A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component… | ||||
| CVE-2020-15074US | high7.5 | — | ||
OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circu… | ||||
| CVE-2022-2503US | medium6.7 | — | ||
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-map… | ||||
| CVE-2024-47086US | medium6.5 | — | ||
This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker c… | ||||
| CVE-2022-23501US | medium6.5 | — | ||
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. R… | ||||
| CVE-2024-43441US | — | — | ||
Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.
This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.
Users are recommend… | ||||
| CVE-2022-40703US | medium6.1 | — | ||
CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior
on Android allows an unauthenticated attacker with physical acce… | ||||
| CVE-1999-1473US | medium5.0 | — | ||
When a Web site redirects the browser to another site, Internet Explorer 3.02 and 4.0 automatically resends authentication information to the second site, aka the "Page Redirect Is… | ||||
| CVE-2023-47127US | medium5.4 | — | ||
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.… | ||||
| CVE-2021-1561US | medium5.4 | — | ||
A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attac… | ||||
| CVE-2026-80092US | medium5.3 | — | ||
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. | ||||
03
attack patterns (8)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan