CWE-289 · Authentication
Authentication Bypass by Alternate Name
46CVEs
SortMost likely exploited
46 CVEs with CWE-289 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-56511CheckDataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversaldataease · dataease · CVSS 9.3 · 2025-01-10 | 9.3 | 50% | 2025-01-10 |
| CVE-2021-34746Cisco Enterprise NFV Infrastructure Software Authentication Bypass VulnerabilityCisco · Cisco Enterprise NFV Infrastructure Software · CVSS 9.8 · 2021-09-02 | 9.8 | 18% | 2021-09-02 |
| CVE-2026-50627Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token ValidatorApache Software Foundation · Apache CXF · CVSS 9.1 · 2026-06-12 | 9.1 | 4.1% | 2026-06-12 |
| CVE-2017-16590This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is requi…NetGain Systems · NetGain Systems Enterprise Manager · 2018-01-23 | – | 3.3% | 2018-01-23 |
| CVE-2025-55130A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directorie…nodejs · node · CVSS 7.1 · 2026-01-20 | 7.1 | 1.7% | 2026-01-20 |
| CVE-2023-20046A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. Thi…Cisco · Cisco ASR 5000 Series Software · CVSS 8.8 · 2023-05-09 | 8.8 | 1.6% | 2023-05-09 |
| CVE-2023-38487HedgeDoc API allows to hide existing noteshedgedoc · hedgedoc · CVSS 6.5 · 2023-08-04 | 6.5 | 0.8% | 2023-08-04 |
| CVE-2023-1803Authentication Bypass in Redline RouterDTS Electronics · Redline Router · CVSS 9.8 · 2023-04-14 | 9.8 | 0.8% | 2023-04-14 |
| CVE-2023-41890Sustainsys.Saml2 Insufficient Identity Provider Issuer ValidationSustainsys · Saml2 · CVSS 7.5 · 2023-09-19 | 7.5 | 0.8% | 2023-09-19 |
| CVE-2026-8457WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWTWPWeb · WooCommerce - Social Login · CVSS 9.8 · 2026-08-01 | 9.8 | 0.7% | 2026-08-01 |
| CVE-2023-3263The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when…Dataprobe · iBoot PDU · CVSS 7.5 · 2023-08-14 | 7.5 | 0.7% | 2023-08-14 |
| CVE-2026-15980MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation TokenTangibleWP · MyHome Core · CVSS 9.8 · 2026-08-30 | 9.8 | 0.7% | 2026-08-30 |
| CVE-2026-56091Apache Shiro: Authentication bypass in Guice-Web integrationApache Software Foundation · Apache Shiro · CVSS 8.2 · 2026-06-25 | 8.2 | 0.7% | 2026-06-25 |
| CVE-2024-51996Symphony has an Authentication Bypass via RememberMesymfony · symfony · CVSS 7.5 · 2024-11-13 | 7.5 | 0.6% | 2024-11-13 |
| CVE-2026-24058Soft Serve has Critical Authentication Bypasscharmbracelet · soft-serve · CVSS 8.1 · 2026-01-22 | 8.1 | 0.6% | 2026-01-22 |
| CVE-2026-76183Apache Tomcat: Bypass of security constraints for WebSocket endpointsApache Software Foundation · Apache Tomcat · CVSS 9.8 · 2026-09-23 | 9.8 | 0.6% | 2026-09-23 |
| CVE-2026-15985Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP LoginRadiusTheme · Classified Listing - Mobile Number Verification · CVSS 8.1 · 2026-08-26 | 8.1 | 0.5% | 2026-08-26 |
| CVE-2026-10842IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerabilityIBM · WebSphere Application Server · CVSS 7.5 · 2026-07-30 | 7.5 | 0.5% | 2026-07-30 |
| CVE-2025-13613Elated Membership <= 1.2 - Authentication Bypass via Social LoginElated Themes · Elated Membership · CVSS 9.8 · 2025-12-10 | 9.8 | 0.5% | 2025-12-10 |
| CVE-2026-100351kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusiongetkin · kin-openapi · CVSS 7.4 · 2026-10-15 | 7.4 | 0.5% | 2026-10-15 |
| CVE-2026-9701Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalationjoe007 · Eventer · CVSS 9.8 · 2026-07-08 | 9.8 | 0.5% | 2026-07-08 |
| CVE-2026-55075Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypasscoder · coder · CVSS 7.4 · 2026-07-07 | 7.4 | 0.5% | 2026-07-07 |
| CVE-2026-32639Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploadswintercms · winter · CVSS 6.8 · 2026-08-26 | 6.8 | 0.5% | 2026-08-26 |
| CVE-2026-32036OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channelsOpenClaw · OpenClaw · CVSS 6.5 · 2026-03-19 | 6.5 | 0.5% | 2026-03-19 |
| CVE-2024-2098Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrarycodename065 · Download Manager · CVSS 7.5 · 2024-06-13 | 7.5 | 0.5% | 2024-06-13 |
| CVE-2025-41248CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized typesVMware · Spring Security · CVSS 7.5 · 2025-09-16 | 7.5 | 0.4% | 2025-09-16 |
| CVE-2026-3184Util-linux: util-linux: access control bypass due to improper hostname canonicalizationRed Hat · Red Hat Hardened Images · CVSS 3.7 · 2026-04-03 | 3.7 | 0.4% | 2026-04-03 |
| CVE-2024-11283WP JobHunt <= 7.1 - Authentication Bypass to CandidateChimpgroup · WP JobHunt · CVSS 7.5 · 2025-03-14 | 7.5 | 0.4% | 2025-03-14 |
| CVE-2025-29266Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use…Unraid · Unraid · CVSS 9.6 · 2025-03-31 | 9.6 | 0.4% | 2025-03-31 |
| CVE-2026-23903Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystemsApache Software Foundation · Apache Shiro · CVSS 5.3 · 2026-02-09 | 5.3 | 0.4% | 2026-02-09 |
| CVE-2024-34519Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashboard with an auto-login user, data disc…No vendor recorded · CVSS 6.8 · 2024-05-05 | 6.8 | 0.4% | 2024-05-05 |
| CVE-2026-73511Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)envoyproxy · envoy · CVSS 5.3 · 2026-09-21 | 5.3 | 0.4% | 2026-09-21 |
| CVE-2026-12101Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessIBM · Verify Identity Access · CVSS 8.1 · 2026-09-15 | 8.1 | 0.4% | 2026-09-15 |
| CVE-2023-51663Hail authentication can be bypassed by changing email addresshail-is · hail · CVSS 5.3 · 2023-12-29 | 5.3 | 0.4% | 2023-12-29 |
| CVE-2025-8415Cryostat: authentication bypass if network policies are disabledCryostat · Cryostat · CVSS 5.9 · 2025-08-20 | 5.9 | 0.4% | 2025-08-20 |
| CVE-2025-14777Keycloak: keycloak idor in realm client creating/deletingRed Hat · Red Hat build of Keycloak 26.4 · CVSS 6 · 2025-12-16 | 6.0 | 0.3% | 2025-12-16 |
| CVE-2026-95514WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerabilitynetgsm · Netgsm · CVSS 5.3 · 2026-09-23 | 5.3 | 0.3% | 2026-09-23 |
| CVE-2026-43617Rsync < 3.4.3 Authorization Bypass via Hostname ResolutionRsyncProject · rsync · CVSS 4.8 · 2026-05-20 | 4.8 | 0.3% | 2026-05-20 |
| CVE-2025-60375The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation. By sending empty username and pass…No vendor recorded · CVSS 7.3 · 2025-10-09 | 7.3 | 0.3% | 2025-10-09 |
| CVE-2026-92579AVideo through 29.0 Broken Access Control via CSRF Exemption Basename CollisionWWBN · AVideo · CVSS 5.4 · 2026-09-16 | 5.4 | 0.3% | 2026-09-16 |
| CVE-2026-126615Authentication Bypass by Alternate Name in hMailServerProgressive Robot Ltd · hMailServer · CVSS 5.3 · 2026-11-11 | 5.3 | 0.3% | 2026-11-11 |
| CVE-2026-104143DataEase: Stored SQL Injection via dateFormat field templatesdataease · dataease · CVSS 8.7 · 2026-10-14 | 8.7 | 0.3% | 2026-10-14 |
| CVE-2025-64521authentik deactivated service accounts can authenticate to OAuthgoauthentik · authentik · CVSS 4.8 · 2025-11-19 | 4.8 | 0.2% | 2025-11-19 |
| CVE-2026-57176social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backendpython-social-auth · social-core · CVSS 6.8 · 2026-09-24 | 6.8 | 0.2% | 2026-09-24 |
| CVE-2024-20811Improper caller verification in GameOptimizer prior to SMR Feb-2024 Release 1 allows local attackers to configure GameOptimizer.Samsung Mobile · Samsung Mobile Devices · CVSS 5.1 · 2024-02-06 | 5.1 | 0.1% | 2024-02-06 |
| CVE-2025-64343(conda) Constructor: Excessive permissions during and after installationconda · constructor · CVSS 7.8 · 2025-11-07 | 7.8 | 0.1% | 2025-11-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.