CWE-305 · Authentication
Authentication Bypass by Primary Weakness
176CVEs
SortMost likely exploited
176 CVEs with CWE-305 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-31161In CISA KEVExploitedCrushFTP - Authentication BypassCrushFTP · CrushFTP · CVSS 9.8 · 2025-04-03 | 9.8 | 100% | 2025-04-03 |
| CVE-2026-81578In CISA KEVExploitedPaperCut NG/MF <=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-DirectPaperCut · PaperCut MF/NG · CVSS 8.8 · 2026-08-28 | 8.8 | 85% | 2026-08-28 |
| CVE-2024-37085In CISA KEVExploitedVMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was prev…VMware · VMware ESXi · CVSS 6.8 · 2024-06-25 | 6.8 | 27% | 2024-06-25 |
| CVE-2023-34124CheckSonicWall GMS and Analytics Web Services - Shell InjectionSonicWall · GMS · CVSS 9.8 · 2023-07-13 | 9.8 | 50% | 2023-07-13 |
| CVE-2026-2652CheckMLflow < 3.10.0 - Authentication Bypass on FastAPI Routesmlflow · mlflow/mlflow · CVSS 8.6 · 2026-05-15 | 8.6 | 21% | 2026-05-15 |
| CVE-2023-0777Checkmodoboa 2.0.4 - Admin TakeOvermodoboa · modoboa/modoboa · CVSS 8.6 · 2023-02-10 | 8.6 | 15% | 2023-02-10 |
| CVE-2026-25555CheckOpenBullet2 <= 0.3.2 - Authentication Bypassopenbullet · openbullet2 · CVSS 9.8 · 2026-06-08 | 9.8 | 2.3% | 2026-06-08 |
| CVE-2026-30849CheckMantisBT < 2.28.1 - SOAP API Authentication Bypassmantisbt · mantisbt · CVSS 9.3 · 2026-03-23 | 9.3 | 1.8% | 2026-03-23 |
| CVE-2026-86207CheckN-able N-central - Authentication BypassN-able · N-central · CVSS 7.7 · 2026-09-05 | 7.7 | 1.3% | 2026-09-05 |
| CVE-2025-56132CheckLiquidFiles < 4.2 - User Enumeration via Password ResetLiquidfiles · Liquidfiles · CVSS 7.3 · 2025-09-30 | 7.3 | 0.8% | 2025-09-30 |
| CVE-2020-10923This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required…NETGEAR · R6700 · CVSS 6.5 · 2020-07-28 | 6.5 | 85% | 2020-07-28 |
| CVE-2023-28126An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the…Ivanti · Avalanche · CVSS 5.9 · 2023-05-09 | 5.9 | 67% | 2023-05-09 |
| CVE-2025-32011KUNBUS Revolution Pi Authentication Bypass by Primary WeaknessKUNBUS GmbH · Revolution Pi PiCtory · CVSS 9.8 · 2025-05-01 | 9.8 | 29% | 2025-05-01 |
| CVE-2021-26102A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system…Fortinet · FortiWAN · CVSS 9.8 · 2024-12-19 | 9.8 | 20% | 2024-12-19 |
| CVE-2024-20674Windows Kerberos Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8.8 · 2024-01-09 | 8.8 | 17% | 2024-01-09 |
| CVE-2022-2651Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrmbookwyrm-social · bookwyrm-social/bookwyrm · CVSS 9.8 · 2022-08-04 | 9.8 | 16% | 2022-08-04 |
| CVE-2025-13915Authentication bypass in IBM API ConnectIBM · API Connect · CVSS 9.8 · 2025-12-26 | 9.8 | 9.0% | 2025-12-26 |
| CVE-2026-4670Improper Authentication vulnerability in Progress MOVEit AutomationProgress Software · MOVEit Automation · CVSS 9.8 · 2026-04-30 | 9.8 | 5.0% | 2026-04-30 |
| CVE-2020-15078OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can…Openvpn · OpenVPN · 2021-04-26 | – | 4.9% | 2021-04-26 |
| CVE-2022-0547OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies,…Openvpn · OpenVPN · CVSS 9.8 · 2022-03-18 | 9.8 | 3.5% | 2022-03-18 |
| CVE-2024-1403Authentication Bypass in OpenEdge Authentication Gateway and AdminServerProgress · OpenEdge · CVSS 10 · 2024-02-27 | 10.0 | 3.3% | 2024-02-27 |
| CVE-2019-3878A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (…uninett · mod_auth_mellon · CVSS 8.1 · 2019-03-26 | 8.1 | 3.0% | 2019-03-26 |
| CVE-2021-3850Authentication Bypass by Primary Weakness in adodb/adodbadodb · adodb/adodb · CVSS 9.1 · 2022-01-25 | 9.1 | 2.2% | 2022-01-25 |
| CVE-2020-11012Authentication bypass MinIO Admin APIMinIO · minio · CVSS 9.3 · 2020-04-23 | 9.3 | 1.9% | 2020-04-23 |
| CVE-2019-14833A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a…Samba · samba · CVSS 4.2 · 2019-11-06 | 4.2 | 1.9% | 2019-11-06 |
| CVE-2023-27535An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Pr…Haxx · https://github.com/curl/curl · CVSS 5.9 · 2023-03-30 | 5.9 | 1.8% | 2023-03-30 |
| CVE-2023-27536An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due…Haxx · https://github.com/curl/curl · CVSS 5.9 · 2023-03-30 | 5.9 | 1.8% | 2023-03-30 |
| CVE-2020-15787A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the informatio…Siemens · SIMATIC HMI Unified Comfort Panels · 2020-09-09 | – | 1.5% | 2020-09-09 |
| CVE-2023-27538An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified,…Haxx · https://github.com/curl/curl · CVSS 7.7 · 2023-03-30 | 7.7 | 1.5% | 2023-03-30 |
| CVE-2021-21403Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/serverkongchuanhujiao · server · CVSS 7.5 · 2021-03-26 | 7.5 | 1.4% | 2021-03-26 |
| CVE-2021-3547OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same…Openvpn · OpenVPN 3 Core Library · 2021-07-12 | – | 1.2% | 2021-07-12 |
| CVE-2020-15077OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authenticat…Openvpn · OpenVPN Access Server · 2021-06-04 | – | 1.2% | 2021-06-04 |
| CVE-2022-4722Authentication Bypass by Primary Weakness in ikus060/rdiffwebikus060 · ikus060/rdiffweb · CVSS 7.2 · 2022-12-23 | 7.2 | 1.2% | 2022-12-23 |
| CVE-2021-43175The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that imple…GOautodial · GOautodial API · 2021-12-07 | – | 1.2% | 2021-12-07 |
| CVE-2024-34077MantisBT user account takeover in the signup/reset password processmantisbt · mantisbt · CVSS 7.3 · 2024-05-13 | 7.3 | 1.2% | 2024-05-13 |
| CVE-2021-26726Remote code execution in Valmet DNA before Collection 2021Valmet DNA · Valmet DNA · CVSS 8.8 · 2022-02-16 | 8.8 | 1.1% | 2022-02-16 |
| CVE-2024-50478WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerabilitySwoop · 1-Click Login: Passwordless Authentication · CVSS 9.8 · 2024-10-28 | 9.8 | 1.1% | 2024-10-28 |
| CVE-2019-14909A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.Redhat · Keycloak · CVSS 9.3 · 2019-12-04 | 9.3 | 1.1% | 2019-12-04 |
| CVE-2023-1307Authentication Bypass by Primary Weakness in froxlor/froxlorfroxlor · froxlor/froxlor · CVSS 9.8 · 2023-03-10 | 9.8 | 1.1% | 2023-03-10 |
| CVE-2019-14910A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case…Redhat · Keycloak · CVSS 9.3 · 2019-12-05 | 9.3 | 1.1% | 2019-12-05 |
| CVE-2023-27582Full authentication bypass if SASL authorization username is specifiedfoxcpp · maddy · CVSS 9.1 · 2023-03-13 | 9.1 | 1.0% | 2023-03-13 |
| CVE-2023-34137SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affe…SonicWall · GMS · 2023-07-13 | – | 1.0% | 2023-07-13 |
| CVE-2022-0451Auth bypass in Dark SDKGoogle LLC · Dart SDK · CVSS 6.5 · 2022-02-18 | 6.5 | 1.0% | 2022-02-18 |
| CVE-2024-7557Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift aiRed Hat · RHOAI-2.14-RHEL-8 · CVSS 8.8 · 2024-08-08 | 8.8 | 1.0% | 2024-08-08 |
| CVE-2025-41450Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2Danfoss · AK-SM 8xxA Series · CVSS 8.2 · 2025-05-08 | 8.2 | 1.0% | 2025-05-08 |
| CVE-2020-14359A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass our Gatekeeper. Lower case headers are a…Redhat · keycloak · 2021-02-23 | – | 0.9% | 2021-02-23 |
| CVE-2025-46801Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be ab…PgPool Global Development Group · Pgpool-II · CVSS 9.3 · 2025-05-19 | 9.3 | 0.9% | 2025-05-19 |
| CVE-2023-20154Cisco Modeling Labs External Authentication Bypass VulnerabilityCisco · Cisco Modeling Labs · CVSS 9.1 · 2024-11-15 | 9.1 | 0.9% | 2024-11-15 |
| CVE-2024-1202Authentication Bypass in XPodas' OctopodXPodas · Octopod · CVSS 9.8 · 2024-03-05 | 9.8 | 0.9% | 2024-03-05 |
| CVE-2024-3847Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium sec…Google · Chrome · CVSS 9.8 · 2024-04-17 | 9.8 | 0.9% | 2024-04-17 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.