CWE-603 Use of Client-Side Authentication
baseA client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (30)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3218US | critical9.8 | Exploit | ||
Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code exec… | ||||
| CVE-2025-62650US | critical9.9 | — | ||
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen. | ||||
| CVE-2017-7909US | critical9.8 | — | ||
A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses JavaScript to check client aut… | ||||
| CVE-2016-2275US | critical9.8 | — | ||
The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access c… | ||||
| CVE-2024-39375US | critical9.8 | — | ||
TELSAT marKoni FM Transmitters are vulnerable to an attacker bypassing authentication and gaining administrator privileges. | ||||
| CVE-2022-33139US | critical9.8 | — | ||
A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All versions in default conf… | ||||
| CVE-2021-43355US | critical9.8 | — | ||
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server s… | ||||
| CVE-2020-7591US | high8.8 | — | ||
A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the s… | ||||
| CVE-2025-61940US | high8.8 | — | ||
NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password… | ||||
| CVE-2026-90983US | high8.2 | — | ||
Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.
This issue affects Hayat Mobile: from 3… | ||||
| CVE-2025-30042US | high7.8 | — | ||
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used… | ||||
| CVE-2020-6988US | high7.5 | — | ||
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior… | ||||
| CVE-2024-45785US | high7.5 | — | ||
MUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability is exploited, other users' credential and sensitive information may be retrieved. | ||||
| CVE-2026-66305US | high7.1 | — | ||
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2020-27266US | medium6.5 | — | ||
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications al… | ||||
| CVE-2025-62649US | medium5.8 | — | ||
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders. | ||||
| CVE-2026-3096US | — | — | ||
The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowin… | ||||
| CVE-2026-76945US | — | — | ||
The affected Ebyte device relies on client-managed authentication tokens
without sufficient server-side validation. An attacker may replay or
manipulate authentication tokens to… | ||||
| CVE-2026-71187US | — | — | ||
The Ebyte device relies on client side authentication logic that can be
reproduced by unauthenticated users. An attacker may generate valid
authentication requests and bypass aut… | ||||
| CVE-2026-42098US | — | — | ||
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan