CWE-287
Improper Authentication
Description
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-114 · CAPEC-115 · CAPEC-151 · CAPEC-194 · CAPEC-22 · CAPEC-57 · CAPEC-593 · CAPEC-633 · CAPEC-650 · CAPEC-94
CVEs mapped to this weakness (4,804)
page 192 of 241| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2006-5268 | 0.01 | — | 0.07 | Nov 17, 2008 | Unspecified vulnerability in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via vectors related to obtaining "administrative access to the RPC interface." | |||
| CVE-2008-3703 | 0.01 | — | 0.12 | Aug 18, 2008 | The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to… | |||
| CVE-2006-2380 | 0.01 | — | 0.18 | Jun 13, 2006 | Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the "RPC Mutual Authentication Vulnerability." | |||
| CVE-2026-54176 | 0.00 | — | — | Aug 20, 2026 | ## Summary `MyAccountController::postAccountInfoForm` allows an authenticated user to update the authentication column (default: `email`) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's… | |||
| CVE-2026-55235 | 0.00 | — | — | Aug 19, 2026 | ## Summary In affected versions of `langgraph-api` (the LangGraph Server runtime), a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback… | |||
| CVE-2026-16055 | Hig | 0.00 | 7.5 | 0.00 | Aug 5, 2026 | The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and… | ||
| CVE-2026-16036 | Hig | 0.00 | 7.5 | 0.00 | Aug 5, 2026 | The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an… | ||
| CVE-2026-15372 | Hig | 0.00 | 7.5 | 0.00 | Aug 5, 2026 | The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account,… | ||
| CVE-2026-15210 | Cri | 0.00 | 9.1 | 0.00 | Aug 5, 2026 | The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code… | ||
| CVE-2026-18759 | Hig | 0.00 | — | 0.00 | Aug 4, 2026 | The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local… | ||
| CVE-2026-11366 | Low | 0.00 | 3.7 | 0.00 | Aug 4, 2026 | The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets… | ||
| CVE-2026-8508 | Med | 0.00 | 6.5 | 0.01 | Aug 4, 2026 | An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication. | ||
| CVE-2026-14557 | Cri | 0.00 | 9.1 | 0.00 | Aug 3, 2026 | The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's… | ||
| CVE-2026-16261 | Hig | 0.00 | 7.5 | 0.00 | Aug 2, 2026 | The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's… | ||
| CVE-2026-15206 | Hig | 0.00 | 7.5 | 0.00 | Aug 2, 2026 | The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to… | ||
| CVE-2026-12586 | Hig | 0.00 | 8.1 | 0.00 | Aug 2, 2026 | The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the… | ||
| CVE-2026-14561 | Med | 0.00 | 6.5 | 0.00 | Aug 1, 2026 | The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user… | ||
| CVE-2026-14919 | Cri | 0.00 | 9.8 | 0.00 | Jul 31, 2026 | The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including… | ||
| CVE-2026-14830 | Hig | 0.00 | 7.5 | 0.00 | Jul 31, 2026 | The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying. | ||
| CVE-2026-12695 | Hig | 0.00 | 8.1 | 0.00 | Jul 31, 2026 | The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass… |
- CVE-2006-5268Nov 17, 2008risk 0.01cvss —epss 0.07
Unspecified vulnerability in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via vectors related to obtaining "administrative access to the RPC interface."
- CVE-2008-3703Aug 18, 2008risk 0.01cvss —epss 0.12
The management console in the Volume Manager Scheduler Service (aka VxSchedService.exe) in Symantec Veritas Storage Foundation for Windows (SFW) 5.0, 5.0 RP1a, and 5.1 accepts NULL NTLMSSP authentication, which allows remote attackers to execute arbitrary code via requests to…
- CVE-2006-2380Jun 13, 2006risk 0.01cvss —epss 0.18
Microsoft Windows 2000 SP4 does not properly validate an RPC server during mutual authentication over SSL, which allows remote attackers to spoof an RPC server, aka the "RPC Mutual Authentication Vulnerability."
- CVE-2026-54176Aug 20, 2026risk 0.00cvss —epss —
## Summary `MyAccountController::postAccountInfoForm` allows an authenticated user to update the authentication column (default: `email`) without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's…
- CVE-2026-55235Aug 19, 2026risk 0.00cvss —epss —
## Summary In affected versions of `langgraph-api` (the LangGraph Server runtime), a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback…
- risk 0.00cvss 7.5epss 0.00
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and…
- risk 0.00cvss 7.5epss 0.00
The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an…
- risk 0.00cvss 7.5epss 0.00
The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account,…
- risk 0.00cvss 9.1epss 0.00
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code…
- risk 0.00cvss —epss 0.00
The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local…
- risk 0.00cvss 3.7epss 0.00
The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets…
- risk 0.00cvss 6.5epss 0.01
An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 could allow an attacker on the WLAN to bypass captive portal authentication.
- risk 0.00cvss 9.1epss 0.00
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's…
- risk 0.00cvss 7.5epss 0.00
The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's…
- risk 0.00cvss 7.5epss 0.00
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to…
- risk 0.00cvss 8.1epss 0.00
The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce, allowing unauthenticated attackers to reset the password of any user (including an administrator) and take over the…
- risk 0.00cvss 6.5epss 0.00
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user…
- risk 0.00cvss 9.8epss 0.00
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including…
- risk 0.00cvss 7.5epss 0.00
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.
- risk 0.00cvss 8.1epss 0.00
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass…