CWE-1390 · Authentication
Weak Authentication
129CVEs
SortMost likely exploited
129 CVEs with CWE-1390 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-55040In CISA KEVExploitedMicrosoft SharePoint Server - JWT Authentication BypassMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 9.1 · 2026-07-14 | 9.1 | 70% | 2026-07-14 |
| CVE-2025-40554CheckSolarWinds Web Help Desk - Authentication BypassSolarWinds · Web Help Desk · CVSS 9.8 · 2026-01-28 | 9.8 | 61% | 2026-01-28 |
| CVE-2025-40552CheckSolarWinds Web Help Desk - Authentication BypassSolarWinds · Web Help Desk · CVSS 9.8 · 2026-01-28 | 9.8 | 52% | 2026-01-28 |
| CVE-2025-27740Active Directory Certificate Services Elevation of Privilege VulnerabilityMicrosoft · Windows Server 2008 R2 Service Pack 1 · CVSS 8.8 · 2025-04-08 | 8.8 | 3.5% | 2025-04-08 |
| CVE-2026-96940Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft Exchange Server 2016 Cumulative Update 23 · CVSS 8.8 · 2026-10-02 | 8.8 | 2.7% | 2026-10-02 |
| CVE-2026-44237FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API ModuleFreePBX · security-reporting · CVSS 7.6 · 2026-05-29 | 7.6 | 2.7% | 2026-05-29 |
| CVE-2024-49019Active Directory Certificate Services Elevation of Privilege VulnerabilityMicrosoft · Windows Server 2019 · CVSS 7.8 · 2024-11-12 | 7.8 | 2.0% | 2024-11-12 |
| CVE-2024-38239Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 7.2 · 2024-09-10 | 7.2 | 1.7% | 2024-09-10 |
| CVE-2025-26635Windows Hello Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6.5 · 2025-04-08 | 6.5 | 1.5% | 2025-04-08 |
| CVE-2023-24890Microsoft OneDrive for iOS Security Feature Bypass VulnerabilityMicrosoft · OneDrive for iOS · CVSS 6.5 · 2023-03-14 | 6.5 | 1.2% | 2023-03-14 |
| CVE-2024-8322Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality.Ivanti · Endpoint Manager · CVSS 4.3 · 2024-09-10 | 4.3 | 1.1% | 2024-09-10 |
| CVE-2022-43400A vulnerability has been identified in Siveillance Video Mobile Server V2022 R2 (All versions < V22.2a (80)). The mobile server component of affected applications improperly handl…Siemens · Siveillance Video Mobile Server V2022 R2 · CVSS 9.8 · 2022-10-21 | 9.8 | 1.1% | 2022-10-21 |
| CVE-2025-24070ASP.NET Core and Visual Studio Elevation of Privilege VulnerabilityMicrosoft · ASP.NET Core 8.0 · CVSS 7 · 2025-03-11 | 7.0 | 1.0% | 2025-03-11 |
| CVE-2026-118157Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft Exchange Server Subscription Edition RTM · CVSS 7.2 · 2026-11-10 | 7.2 | 1.0% | 2026-11-10 |
| CVE-2026-65098NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerabil…NVIDIA · NemoClaw · CVSS 8.1 · 2026-08-25 | 8.1 | 1.0% | 2026-08-25 |
| CVE-2024-35248Microsoft Dynamics 365 Business Central Elevation of Privilege VulnerabilityMicrosoft · Microsoft Dynamics 365 Business Central 2023 Release Wave 1 · CVSS 7.3 · 2024-06-11 | 7.3 | 1.0% | 2024-06-11 |
| CVE-2023-41900Jetty's OpenId Revoked authentication allows one requesteclipse · jetty.project · CVSS 3.5 · 2023-09-15 | 3.5 | 0.9% | 2023-09-15 |
| CVE-2025-26343A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-forc…Q-Free · MaxTime · CVSS 8.1 · 2025-02-12 | 8.1 | 0.9% | 2025-02-12 |
| CVE-2026-73025Windows iSCSI Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 9.8 · 2026-09-08 | 9.8 | 0.9% | 2026-09-08 |
| CVE-2024-38182Microsoft Dynamics 365 Elevation of Privilege VulnerabilityMicrosoft · Dynamics 365 Field Service (on-premises) v7 series · CVSS 9 · 2024-07-31 | 9.0 | 0.9% | 2024-07-31 |
| CVE-2023-49340An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileges and bypass authentication via incorr…No vendor recorded · CVSS 9.8 · 2024-03-09 | 9.8 | 0.9% | 2024-03-09 |
| CVE-2025-59249Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft Exchange Server 2016 Cumulative Update 23 · CVSS 8.8 · 2025-10-14 | 8.8 | 0.8% | 2025-10-14 |
| CVE-2025-47995Azure Machine Learning Elevation of Privilege VulnerabilityMicrosoft · Azure Machine Learning · CVSS 6.5 · 2025-07-18 | 6.5 | 0.8% | 2025-07-18 |
| CVE-2026-77483SQL Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft SQL Server 2017 (CU 31) · CVSS 8.8 · 2026-09-08 | 8.8 | 0.8% | 2026-09-08 |
| CVE-2025-30411Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acron…Acronis · Acronis Cyber Protect 16 · CVSS 10 · 2026-02-20 | 10.0 | 0.8% | 2026-02-20 |
| CVE-2024-54092A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit…Siemens · Industrial Edge Device Kit - arm64 V1.17 · CVSS 9.8 · 2025-04-08 | 9.8 | 0.8% | 2025-04-08 |
| CVE-2024-34451Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the ven…Ghost · Ghost · CVSS 9.1 · 2024-06-16 | 9.1 | 0.8% | 2024-06-16 |
| CVE-2026-83674Active Directory Federation Services (AD FS) Spoofing VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8.1 · 2026-10-13 | 8.1 | 0.7% | 2026-10-13 |
| CVE-2025-7326EOL ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft · ASP.NET Core 6.0 · CVSS 7 · 2025-07-08 | 7.0 | 0.7% | 2025-07-08 |
| CVE-2025-23058Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) · HPE Aruba Networking ClearPass Policy Manager · CVSS 8.8 · 2025-02-04 | 8.8 | 0.7% | 2025-02-04 |
| CVE-2024-0822Ovirt: authentication bypassRed Hat · Red Hat Virtualization Engine 4.4 · CVSS 7.5 · 2024-01-25 | 7.5 | 0.7% | 2024-01-25 |
| CVE-2023-41862WordPress VS Contact Form plugin <= 14.0 - Sum Captcha Bypass vulnerabilityGuido · VS Contact Form · CVSS 5.3 · 2024-12-13 | 5.3 | 0.7% | 2024-12-13 |
| CVE-2026-119991Microsoft Configuration Manager Information Disclosure VulnerabilityMicrosoft · Microsoft Configuration Manager 2603 · CVSS 5.9 · 2026-11-10 | 5.9 | 0.7% | 2026-11-10 |
| CVE-2025-30412Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acron…Acronis · Acronis Cyber Protect 16 · CVSS 10 · 2026-02-20 | 10.0 | 0.7% | 2026-02-20 |
| CVE-2025-12870aEnrich｜eHRD - Authentication AbuseaEnrich · a+HRD · CVSS 9.8 · 2025-11-12 | 9.8 | 0.7% | 2025-11-12 |
| CVE-2026-83511Active Directory Federation Services (AD FS) Spoofing VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.4 · 2026-10-13 | 7.4 | 0.7% | 2026-10-13 |
| CVE-2026-69982Active Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 5.9 · 2026-10-13 | 5.9 | 0.6% | 2026-10-13 |
| CVE-2026-122164Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 8 · 2026-11-10 | 8.0 | 0.6% | 2026-11-10 |
| CVE-2025-1727End-of-Train and Head-of-Train Remote Linking Protocol Weak AuthenticationEnd-of-Train and Head-of-Train remote linking protocol · End-of-Train and Head-of-Train remote linking protocol · CVSS 8.1 · 2025-07-10 | 8.1 | 0.6% | 2025-07-10 |
| CVE-2026-70005Active Directory Federation Services (AD FS) Security Feature Bypass VulnerabilityMicrosoft · Windows Server 2019 · CVSS 5.9 · 2026-10-13 | 5.9 | 0.6% | 2026-10-13 |
| CVE-2026-69802Network Device Enrollment Service (NDES) Remote Code Execution VulnerabilityMicrosoft · Windows Server 2012 · CVSS 8.1 · 2026-10-13 | 8.1 | 0.6% | 2026-10-13 |
| CVE-2023-53894phpfm 1.7.9 Authentication Bypass via Type Juggling VulnerabilityDulldusk · phpfm · CVSS 9.8 · 2025-12-16 | 9.8 | 0.6% | 2025-12-16 |
| CVE-2025-12871aEnrich｜a+HRD - Authentication AbuseaEnrich · a+HRD · CVSS 9.8 · 2025-11-12 | 9.8 | 0.6% | 2025-11-12 |
| CVE-2026-85922Azure Key Vault Security Feature Bypass VulnerabilityMicrosoft · azure_security_keyvault_certificates · CVSS 7.4 · 2026-10-13 | 7.4 | 0.6% | 2026-10-13 |
| CVE-2025-39596WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation VulnerabilityQuentn.com GmbH · Quentn WP · CVSS 9.8 · 2025-04-17 | 9.8 | 0.6% | 2025-04-17 |
| CVE-2025-1387Learning Digital Orca HCM - Improper AuthenticationLearning Digital · Orca HCM · CVSS 9.8 · 2025-02-17 | 9.8 | 0.6% | 2025-02-17 |
| CVE-2025-50173Windows Installer Elevation of Privilege VulnerabilityMicrosoft · Multimedia Redirection Installer · CVSS 7.8 · 2025-08-12 | 7.8 | 0.6% | 2025-08-12 |
| CVE-2025-49201A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, Fort…Fortinet · FortiPAM · CVSS 7.4 · 2025-10-14 | 7.4 | 0.6% | 2025-10-14 |
| CVE-2024-13239Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003Drupal · Two-factor Authentication (TFA) · CVSS 9.8 · 2025-01-09 | 9.8 | 0.6% | 2025-01-09 |
| CVE-2026-118735Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2026-11-10 | 7.5 | 0.6% | 2026-11-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.