CWE-303
Incorrect Implementation of Authentication Algorithm
BaseDraft
Description
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
This incorrect implementation may allow authentication to be bypassed.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-90
CVEs mapped to this weakness (101)
page 6 of 6| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-21378 | Hig | 0.00 | 8.2 | 0.02 | Mar 11, 2021 | Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the… |
- risk 0.00cvss 8.2epss 0.02
Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the…