CWE-303 · Authentication
Incorrect Implementation of Authentication Algorithm
114CVEs
SortMost likely exploited
114 CVEs with CWE-303 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-7593In CISA KEVExploitedIvanti vTM - Authentication BypassIvanti · vTM · CVSS 9.8 · 2024-08-13 | 9.8 | 100% | 2024-08-13 |
| CVE-2023-29357In CISA KEVExploitedMicrosoft SharePoint - Authentication BypassMicrosoft · Microsoft SharePoint Server 2019 · CVSS 9.8 · 2023-06-13 | 9.8 | 100% | 2023-06-13 |
| CVE-2025-13390CheckWP Directory Kit <= 1.4.4 - Authentication Bypasslistingthemes · WP Directory Kit · CVSS 10 · 2025-12-03 | 10.0 | 4.7% | 2025-12-03 |
| CVE-2025-57808CheckESPHome - Authentication Bypassesphome · esphome · CVSS 8.1 · 2025-09-02 | 8.1 | 1.5% | 2025-09-02 |
| CVE-2020-8863This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Auth…D-Link · Multiple Routers · CVSS 8.8 · 2020-03-23 | 8.8 | 78% | 2020-03-23 |
| CVE-2023-32152D-Link DIR-2640 HNAP LoginPassword Authentication Bypass VulnerabilityD-Link · DIR-2640 · CVSS 6.5 · 2024-05-03 | 6.5 | 29% | 2024-05-03 |
| CVE-2023-32148D-Link DIR-2640 HNAP PrivateLogin Authentication Bypass VulnerabilityD-Link · DIR-2640 · CVSS 6.5 · 2024-05-03 | 6.5 | 29% | 2024-05-03 |
| CVE-2022-20695Cisco Wireless LAN Controller Management Interface Authentication Bypass VulnerabilityCisco · Cisco Wireless LAN Controller (WLC) · CVSS 10 · 2022-04-15 | 10.0 | 20% | 2022-04-15 |
| CVE-2020-8861This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is no…D-Link · DAP-1330 · CVSS 8.8 · 2020-02-22 | 8.8 | 6.5% | 2020-02-22 |
| CVE-2026-41103Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege VulnerabilityMicrosoft · Microsoft Confluence SAML SSO plugin · CVSS 9.1 · 2026-05-12 | 9.1 | 5.4% | 2026-05-12 |
| CVE-2018-4841A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform administrative operat…Siemens AG · TIM 1531 IRC · 2018-03-29 | – | 4.7% | 2018-03-29 |
| CVE-2016-9463Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and n…Nextcloud · Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 &… · 2017-03-28 | – | 4.1% | 2017-03-28 |
| CVE-2020-15632This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploi…D-Link · DIR-842 · CVSS 8.8 · 2020-07-23 | 8.8 | 3.5% | 2020-07-23 |
| CVE-2024-4985An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions…GitHub · Enterprise Server · CVSS 10 · 2024-05-20 | 10.0 | 2.6% | 2024-05-20 |
| CVE-2025-21311Windows NTLM V1 Elevation of Privilege VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 9.8 · 2025-01-14 | 9.8 | 2.2% | 2025-01-14 |
| CVE-2021-21902An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. A properly-timed network connection ca…Garrett · Garrett Metal Detectors · CVSS 7.5 · 2021-12-22 | 7.5 | 1.8% | 2021-12-22 |
| CVE-2021-21378JWT authentication bypass with unknown issuer tokenenvoyproxy · envoy · CVSS 8.2 · 2021-03-11 | 8.2 | 1.7% | 2021-03-11 |
| CVE-2022-41985An authentication bypass vulnerability exists in the Authentication functionality of Weston Embedded uC-FTPs v 1.98.00. A specially crafted set of network packets can lead to auth…Weston Embedded · uC-FTPs · CVSS 8.6 · 2023-05-10 | 8.6 | 1.5% | 2023-05-10 |
| CVE-2021-32691Auto-merging Person Records CompromisedApollosProject · apollos-apps · CVSS 8.8 · 2021-06-16 | 8.8 | 1.5% | 2021-06-16 |
| CVE-2022-33736A vulnerability has been identified in Opcenter Quality V13.1 (All versions < V13.1.20220624), Opcenter Quality V13.2 (All versions < V13.2.20220624). The affected applications do…Siemens · Opcenter Quality V13.1 · 2022-07-12 | – | 1.4% | 2022-07-12 |
| CVE-2022-46146Prometheus Exporter Toolkit vulnerable to basic authentication bypassprometheus · exporter-toolkit · CVSS 6.2 · 2022-11-29 | 6.2 | 1.3% | 2022-11-29 |
| CVE-2022-39366DataHub missing JWT signature checkdatahub-project · datahub · CVSS 9.9 · 2022-10-28 | 9.9 | 1.1% | 2022-10-28 |
| CVE-2023-34282D-Link DIR-2150 HNAP Incorrect Implementation of Authentication Algorithm Authentication Bypass VulnerabilityD-Link · DIR-2150 · CVSS 8.8 · 2024-05-03 | 8.8 | 1.1% | 2024-05-03 |
| CVE-2023-34274D-Link DIR-2150 LoginPassword Incorrect Implementation of Authentication Algorithm Authentication Bypass VulnerabilityD-Link · DIR-2150 · CVSS 8.8 · 2024-05-03 | 8.8 | 1.1% | 2024-05-03 |
| CVE-2023-3326Network authentication attack via pam_krb5FreeBSD · FreeBSD · 2023-06-22 | – | 1.1% | 2023-06-22 |
| CVE-2020-5268Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NETSustainsys · Saml2 · CVSS 6.5 · 2020-04-21 | 6.5 | 1.1% | 2020-04-21 |
| CVE-2024-26248Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.5 · 2024-04-09 | 7.5 | 1.0% | 2024-04-09 |
| CVE-2023-44420D-Link DIR-X3260 prog.cgi Incorrect Implementation of Authentication Algorithm Authentication Bypass VulnerabilityD-Link · DIR-X3260 · CVSS 8.8 · 2024-05-03 | 8.8 | 1.0% | 2024-05-03 |
| CVE-2026-83906Windows Shell Spoofing VulnerabilityMicrosoft · Windows 11 version 23H2 · CVSS 6.5 · 2026-10-13 | 6.5 | 1.0% | 2026-10-13 |
| CVE-2025-66489Cal.com Authentication Bypass via bad TOTP + password checkscalcom · cal.com · CVSS 9.9 · 2025-12-03 | 9.9 | 1.0% | 2025-12-03 |
| CVE-2026-11430Grav CMS Scheduler Webhook Authentication Bypass via Null Short-CircuitTrilby Media · grav-plugin-scheduler-webhook · CVSS 7.3 · 2026-08-07 | 7.3 | 1.0% | 2026-08-07 |
| CVE-2022-20923Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers IPSec VPN Server Authentication Bypass VulnerabilityCisco · Cisco Small Business RV Series Router Firmware · CVSS 4 · 2022-09-08 | 4.0 | 1.0% | 2022-09-08 |
| CVE-2023-29129A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3)…Siemens · Mendix SAML (Mendix 7 compatible) · CVSS 9.1 · 2023-06-13 | 9.1 | 0.9% | 2023-06-13 |
| CVE-2024-56128Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryptionApache Software Foundation · Apache Kafka · CVSS 5.3 · 2024-12-18 | 5.3 | 0.8% | 2024-12-18 |
| CVE-2026-50360Windows SMB Server Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 21H2 · CVSS 8.8 · 2026-07-14 | 8.8 | 0.8% | 2026-07-14 |
| CVE-2026-47300ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 8.8 · 2026-07-14 | 8.8 | 0.8% | 2026-07-14 |
| CVE-2026-28446OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix MatchingOpenClaw · OpenClaw · CVSS 9.4 · 2026-03-05 | 9.4 | 0.7% | 2026-03-05 |
| CVE-2026-57852Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token CheckTrilby Media · Grav CMS scheduler-webhook plugin · CVSS 5.6 · 2026-07-20 | 5.6 | 0.7% | 2026-07-20 |
| CVE-2021-42146An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum s…Contiki-Ng · Tinydtls · CVSS 7.5 · 2024-01-24 | 7.5 | 0.7% | 2024-01-24 |
| CVE-2024-4332Improper Authentication in Tripwire Enterprise 9.1.0 APIsFortra · Tripwire Enterprise · CVSS 9.3 · 2024-06-03 | 9.3 | 0.6% | 2024-06-03 |
| CVE-2026-66028Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client EmailCreativeitem · Ekushey Project Manager CRM · CVSS 6.7 · 2026-07-27 | 6.7 | 0.6% | 2026-07-27 |
| CVE-2026-59309vCenter authentication-bypass vulnerabilityVMware · Cloud Foundation · CVSS 9.8 · 2026-07-30 | 9.8 | 0.6% | 2026-07-30 |
| CVE-2024-10127Support for authentication bypass condition in M-Files LDAP authenticationM-Files Corporation · M-Files Server · CVSS 9.2 · 2024-11-20 | 9.2 | 0.6% | 2024-11-20 |
| CVE-2022-43635This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) routers. Authentication i…TP-Link · TL-WR940N · CVSS 6.5 · 2023-03-29 | 6.5 | 0.6% | 2023-03-29 |
| CVE-2024-5658CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After UseBorn05 · CraftCMS Plugin - Two-Factor Authentication · CVSS 4.8 · 2024-06-06 | 4.8 | 0.6% | 2024-06-06 |
| CVE-2026-126151A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, Forti…Fortinet · FortiMail · CVSS 7.5 · 2026-11-11 | 7.5 | 0.6% | 2026-11-11 |
| CVE-2022-4861Incorrect Implementation of Authentication AlgorithmM-Files · M-Files Client · CVSS 4.8 · 2022-12-30 | 4.8 | 0.6% | 2022-12-30 |
| CVE-2025-63210The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit this issue by modifyi…Newtec · Celoxa504 Firmware · CVSS 9.8 · 2025-11-19 | 9.8 | 0.6% | 2025-11-19 |
| CVE-2023-25957A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0),…Siemens · Mendix SAML (Mendix 7 compatible) · CVSS 9.1 · 2023-03-14 | 9.1 | 0.6% | 2023-03-14 |
| CVE-2024-3046In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthenticated user to retrieve the device lo…Eclipse Foundation · Kura · CVSS 7.5 · 2024-04-09 | 7.5 | 0.6% | 2024-04-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.