CWE-1390
Weak Authentication
Description
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Hierarchy (View 1000)
CVEs mapped to this weakness (89)
page 4 of 5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-47995 | Med | 0.42 | 6.5 | 0.01 | Jul 18, 2025 | Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network. | ||
| CVE-2025-32885 | Med | 0.42 | 6.5 | 0.00 | May 1, 2025 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in… | ||
| CVE-2025-26635 | Med | 0.42 | 6.5 | 0.01 | Apr 8, 2025 | Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network. | ||
| CVE-2025-21552 | Med | 0.42 | 6.5 | 0.00 | Jan 21, 2025 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows low privileged attacker with network access via… | ||
| CVE-2024-47127 | Med | 0.42 | 6.5 | 0.00 | Sep 26, 2024 | In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted… | ||
| CVE-2024-41722 | Med | 0.42 | 6.5 | 0.00 | Sep 26, 2024 | In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an … | ||
| CVE-2024-6580 | Med | 0.42 | 6.5 | 0.00 | Jul 8, 2024 | The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without… | ||
| CVE-2023-4094 | Med | 0.42 | 6.5 | 0.00 | Sep 19, 2023 | ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the… | ||
| CVE-2023-24890 | Med | 0.42 | 6.5 | 0.01 | Mar 14, 2023 | Microsoft OneDrive for iOS Security Feature Bypass Vulnerability | ||
| CVE-2024-45551 | Med | 0.40 | 6.2 | 0.00 | Apr 7, 2025 | Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass. | ||
| CVE-2026-59135 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | ||
| CVE-2025-62844 | Med | 0.36 | 5.5 | 0.00 | Mar 20, 2026 | A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later | ||
| CVE-2026-32497 | Med | 0.34 | 5.3 | 0.00 | Mar 25, 2026 | Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45. | ||
| CVE-2025-47479 | Med | 0.34 | 5.3 | 0.00 | Jul 4, 2025 | Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30. | ||
| CVE-2023-41862 | Med | 0.34 | 5.3 | 0.01 | Dec 13, 2024 | Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0. | ||
| CVE-2022-45860 | Med | 0.34 | 5.3 | 0.00 | May 3, 2023 | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying… | ||
| CVE-2024-32119 | Med | 0.31 | 4.8 | 0.00 | Jun 10, 2025 | An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted… | ||
| CVE-2025-0605 | Med | 0.30 | 4.6 | 0.00 | May 22, 2025 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements. | ||
| CVE-2026-49323 | Med | 0.28 | 4.3 | 0.00 | May 29, 2026 | Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the per-vehicle ECM… | ||
| CVE-2026-49322 | Med | 0.28 | 4.3 | 0.00 | May 29, 2026 | Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN… |
- risk 0.42cvss 6.5epss 0.01
Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
- risk 0.42cvss 6.5epss 0.00
An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in…
- risk 0.42cvss 6.5epss 0.01
Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.
- risk 0.42cvss 6.5epss 0.00
Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows low privileged attacker with network access via…
- risk 0.42cvss 6.5epss 0.00
In the goTenna Pro App there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an unencrypted…
- risk 0.42cvss 6.5epss 0.00
In the goTenna Pro ATAK Plugin there is a vulnerability that makes it possible to inject any custom message with any GID and Callsign using a software defined radio in existing goTenna mesh networks. This vulnerability can be exploited if the device is being used in an …
- risk 0.42cvss 6.5epss 0.00
The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without…
- risk 0.42cvss 6.5epss 0.00
ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the…
- risk 0.42cvss 6.5epss 0.01
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
- risk 0.40cvss 6.2epss 0.00
Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
- risk 0.36cvss 5.5epss 0.00
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later
- risk 0.34cvss 5.3epss 0.00
Weak Authentication vulnerability in PickPlugins User Verification user-verification allows Authentication Abuse.This issue affects User Verification: from n/a through <= 2.0.45.
- risk 0.34cvss 5.3epss 0.00
Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30.
- risk 0.34cvss 5.3epss 0.01
Weak Authentication vulnerability in Guido VS Contact Form allows Authentication Abuse.This issue affects VS Contact Form: from n/a through 14.0.
- risk 0.34cvss 5.3epss 0.00
A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying…
- risk 0.31cvss 4.8epss 0.00
An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted…
- risk 0.30cvss 4.6epss 0.00
An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.
- risk 0.28cvss 4.3epss 0.00
Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the per-vehicle ECM…
- risk 0.28cvss 4.3epss 0.00
Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN…