CWE-302 · Authentication
Authentication Bypass by Assumed-Immutable Data
39CVEs
SortMost likely exploited
39 CVEs with CWE-302 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-43441CheckApache HugeGraph-Server <1.5.0 - Authentication BypassApache Software Foundation · Apache HugeGraph-Server · CVSS 9.8 · 2024-12-24 | 9.8 | 73% | 2024-12-24 |
| CVE-2024-4024Authentication Bypass by Assumed-Immutable Data in GitLabGitLab · GitLab · CVSS 7.3 · 2024-04-25 | 7.3 | 15% | 2024-04-25 |
| CVE-2016-9482PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypassPHP FormMail · Generator · 2018-07-13 | – | 4.5% | 2018-07-13 |
| CVE-2025-29813Azure DevOps Elevation of Privilege VulnerabilityMicrosoft · Azure DevOps · CVSS 10 · 2025-05-08 | 10.0 | 1.6% | 2025-05-08 |
| CVE-2023-4669Authentication Bypass in Exagate SYSGuard 3001Exagate · SYSGuard 3001 · CVSS 9.8 · 2023-09-14 | 9.8 | 1.2% | 2023-09-14 |
| CVE-2023-4612MFA bypass in Apereo CASApereo Foundation · CAS · CVSS 9.8 · 2023-11-09 | 9.8 | 1.2% | 2023-11-09 |
| CVE-2024-49056Airlift.microsoft.com Elevation of Privilege VulnerabilityMicrosoft · airlift.microsoft.com · CVSS 7.3 · 2024-11-12 | 7.3 | 1.1% | 2024-11-12 |
| CVE-2020-15074OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circ…Openvpn · OpenVPN Access Server · 2020-07-14 | – | 1.0% | 2020-07-14 |
| CVE-2022-3875Click Studios Passwordstate API authentication bypass by assumed-immutable dataClick Studios · Passwordstate · CVSS 7.3 · 2022-12-19 | 7.3 | 1.0% | 2022-12-19 |
| CVE-2022-22729CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packet…Yokogawa Electric Corporation · CENTUM CS 3000 · 2022-03-11 | – | 0.9% | 2022-03-11 |
| CVE-2026-47303ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 8.8 · 2026-07-14 | 8.8 | 0.8% | 2026-07-14 |
| CVE-2025-47158Azure DevOps Server Elevation of Privilege VulnerabilityMicrosoft · Azure DevOps · CVSS 9 · 2025-07-18 | 9.0 | 0.8% | 2025-07-18 |
| CVE-2024-12838Changing Information Technology CGFIDO - Authentication BypassChanging Information Technology · CGFIDO · CVSS 8.8 · 2024-12-31 | 8.8 | 0.8% | 2024-12-31 |
| CVE-2021-1561Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access VulnerabilityCisco · Cisco Content Security Management Appliance (SMA) · CVSS 5.4 · 2021-08-18 | 5.4 | 0.7% | 2021-08-18 |
| CVE-2024-56404In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installations are affected.OneIdentity · Identity Manager · CVSS 9.9 · 2025-01-24 | 9.9 | 0.7% | 2025-01-24 |
| CVE-2021-1399Cisco Unified Communications Manager Self Care Portal Authorization Bypass VulnerabilityCisco · Cisco Unified Communications Manager · CVSS 4.3 · 2021-04-08 | 4.3 | 0.6% | 2021-04-08 |
| CVE-2026-80092Microsoft Identity Web Elevation of Privilege VulnerabilityMicrosoft · microsoft-identity-web · CVSS 5.3 · 2026-10-16 | 5.3 | 0.6% | 2026-10-16 |
| CVE-2026-5423Subscription Authentication Bypass via Unverified connectionParams.jwtneo4j · graphql · CVSS 8.2 · 2026-08-06 | 8.2 | 0.6% | 2026-08-06 |
| CVE-2023-47127Weak Authentication in Session Handling in typo3/cms-coreTYPO3 · typo3 · CVSS 4.2 · 2023-11-14 | 4.2 | 0.6% | 2023-11-14 |
| CVE-2026-114277Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local AccountsApache Software Foundation · Apache OFBiz · CVSS 6.5 · 2026-11-05 | 6.5 | 0.5% | 2026-11-05 |
| CVE-2024-3741Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable DataElectrolink · Compact DAB Transmitter · CVSS 7.5 · 2024-04-18 | 7.5 | 0.5% | 2024-04-18 |
| CVE-2025-46647Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connectApache Software Foundation · Apache APISIX · CVSS 5.3 · 2025-07-02 | 5.3 | 0.5% | 2025-07-02 |
| CVE-2024-3462Authorization bypass in Ant Media ServerAnt Media · Ant Media Server Community Edition · CVSS 5.4 · 2024-05-13 | 5.4 | 0.5% | 2024-05-13 |
| CVE-2024-47086OTP Bypass VulnerabilityApex Softcell · LD DP Back Office · CVSS 8.7 · 2024-09-19 | 8.7 | 0.5% | 2024-09-19 |
| CVE-2025-20285Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass VulnerabilityCisco · Cisco Identity Services Engine Software · CVSS 4.1 · 2025-07-16 | 4.1 | 0.5% | 2025-07-16 |
| CVE-2025-26522Authentication Bypass Vulnerability in RupeeWeb trading platformRupeeseed Technology Ventures · RupeeWeb · CVSS 7.5 · 2025-02-14 | 7.5 | 0.4% | 2025-02-14 |
| CVE-2022-2503Linux Kernel LoadPin bypass via dm-verity table reloadLinux Kernel · Linux Kernel · CVSS 6.9 · 2022-08-12 | 6.9 | 0.4% | 2022-08-12 |
| CVE-2024-22179Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable DataElectrolink · Compact DAB Transmitter · CVSS 7.5 · 2024-04-18 | 7.5 | 0.4% | 2024-04-18 |
| CVE-2024-8475Protection Mechanism Failure in Digital Operation Services' WiFiBuradaDigital Operation Services · WiFiBurada · CVSS 6.5 · 2024-12-17 | 6.5 | 0.4% | 2024-12-17 |
| CVE-2022-40703CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attacker with physical acces…AliveCor · Kardia App · CVSS 5.2 · 2022-10-26 | 5.2 | 0.4% | 2022-10-26 |
| CVE-2026-13267Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM · Security Verify Access · CVSS 8.1 · 2026-08-12 | 8.1 | 0.4% | 2026-08-12 |
| CVE-2026-77508Weblate: Unverified REST API email changesWeblateOrg · weblate · CVSS 3.5 · 2026-08-26 | 3.5 | 0.3% | 2026-08-26 |
| CVE-2026-28510elabftw allows MFA bypass during loginelabftw · elabftw · CVSS 5.9 · 2026-05-05 | 5.9 | 0.3% | 2026-05-05 |
| CVE-2024-45370An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database record can lead to u…Socomec · Easy Config System · CVSS 7.3 · 2025-12-01 | 7.3 | 0.2% | 2025-12-01 |
| CVE-2025-43992Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerability in Geo replicat…Dell · ECS · CVSS 5.6 · 2026-05-11 | 5.6 | 0.2% | 2026-05-11 |
| CVE-2026-48781Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgerygitroomhq · postiz-app · CVSS 9.9 · 2026-06-16 | 9.9 | 0.2% | 2026-06-16 |
| CVE-2026-48117DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeoverfduflyer · DroneAware-Node-Releases · CVSS 6.8 · 2026-06-17 | 6.8 | 0.2% | 2026-06-17 |
| CVE-2026-27840ZITADEL's truncated opaque tokens are still validzitadel · zitadel · CVSS 4.3 · 2026-02-26 | 4.3 | 0.2% | 2026-02-26 |
| CVE-2026-34460NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swappingNamelessMC · Nameless · CVSS 5.4 · 2026-06-02 | 5.4 | 0.1% | 2026-06-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.