CWE-305 Authentication Bypass by Primary Weakness
baseThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (221)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-81578US | critical9.8OT critical | KEV | ||
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting… | ||||
| CVE-2025-31161US | critical9.8OT critical | KEV | ||
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild i… | ||||
| CVE-2024-37085US | high7.2OT critical | KEV | ||
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previ… | ||||
| CVE-2020-10923US | high8.8 | Exploit | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required t… | ||||
| CVE-2023-34124US | critical9.8 | Exploit | ||
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier vers… | ||||
| CVE-2022-2651US | critical9.8 | Exploit | ||
Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5. | ||||
| CVE-2023-0777US | critical9.8 | Exploit | ||
Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. | ||||
| CVE-2021-26102US | critical9.1 | Exploit | ||
A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system b… | ||||
| CVE-2026-30849US | critical9.8 | Exploit | ||
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in… | ||||
| CVE-2024-1403US | critical9.8 | Exploit | ||
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has… | ||||
| CVE-2024-50478US | critical9.8 | Exploit | ||
Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordl… | ||||
| CVE-2023-28126US | medium5.9 | — | ||
An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the… | ||||
| CVE-2026-111283US | critical9.0 | Exploit | ||
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrat… | ||||
| CVE-2022-37026US | critical9.8 | — | ||
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and D… | ||||
| CVE-2022-0547US | critical9.8 | — | ||
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, w… | ||||
| CVE-2021-43931US | critical9.8 | — | ||
The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication… | ||||
| CVE-2020-24683US | critical9.8 | — | ||
The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authenticat… | ||||
| CVE-2020-15787US | critical9.8 | — | ||
A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information… | ||||
| CVE-2025-53826US | critical9.8 | — | ||
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’… | ||||
| CVE-2025-4658US | critical9.8 | — | ||
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH depends on the OpenPu… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan