CWE-322 · Cryptography
Key Exchange without Entity Authentication
33CVEs
SortMost likely exploited
33 CVEs with CWE-322 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-1709Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authenticationRed Hat · Red Hat Enterprise Linux 10 · CVSS 9.4 · 2026-02-06 | 9.4 | 5.7% | 2026-02-06 |
| CVE-2022-39249Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsmatrix-org · matrix-js-sdk · CVSS 7.5 · 2022-09-28 | 7.5 | 1.3% | 2022-09-28 |
| CVE-2022-39250Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationmatrix-org · matrix-js-sdk · CVSS 8.6 · 2022-09-29 | 8.6 | 1.2% | 2022-09-29 |
| CVE-2022-39251Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusionmatrix-org · matrix-js-sdk · CVSS 8.6 · 2022-09-28 | 8.6 | 1.2% | 2022-09-28 |
| CVE-2022-39255Matrix iOS SDK vulnerable ton Olm/Megolm protocol confusionmatrix-org · matrix-ios-sdk · CVSS 8.6 · 2022-09-28 | 8.6 | 1.0% | 2022-09-28 |
| CVE-2022-39257Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessionsmatrix-org · matrix-ios-sdk · CVSS 7.5 · 2022-09-28 | 7.5 | 1.0% | 2022-09-28 |
| CVE-2022-39248matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionmatrix-org · matrix-android-sdk2 · CVSS 8.6 · 2022-09-28 | 8.6 | 1.0% | 2022-09-28 |
| CVE-2022-39246matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessionsmatrix-org · matrix-android-sdk2 · CVSS 7.5 · 2022-09-28 | 7.5 | 0.9% | 2022-09-28 |
| CVE-2026-58065Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verificationApache Software Foundation · Apache Airflow Git provider · CVSS 8.1 · 2026-07-13 | 8.1 | 0.7% | 2026-07-13 |
| CVE-2022-39254When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarderpoljar · matrix-nio · CVSS 8.6 · 2022-09-29 | 8.6 | 0.7% | 2022-09-29 |
| CVE-2022-39252When matrix-rust-sdk recieves forwarded room keys, the reciever doesn't check if it requested the key from the forwardermatrix-org · matrix-rust-sdk · CVSS 8.6 · 2022-09-29 | 8.6 | 0.6% | 2022-09-29 |
| CVE-2024-4871Foreman: host ssh key not being checked in remote executionRed Hat · Red Hat Satellite 6.15 for RHEL 8 · CVSS 6.8 · 2024-05-14 | 6.8 | 0.6% | 2024-05-14 |
| CVE-2026-94134Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by defaultApache Software Foundation · Apache Airflow SSH provider · CVSS 9.1 · 2026-10-15 | 9.1 | 0.6% | 2026-10-15 |
| CVE-2026-45361Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)Apache Software Foundation · Apache Airflow Google provider · CVSS 8.1 · 2026-05-25 | 8.1 | 0.6% | 2026-05-25 |
| CVE-2025-62501SSH Hostkey Misconfiguration Vulnerability in Archer DevicesTP-Link Systems Inc. · Archer AX53 v1.0 · CVSS 7 · 2026-02-03 | 7.0 | 0.5% | 2026-02-03 |
| CVE-2026-18654Disabled SSH host key verification in Amazon AWS CLI EMR helper commandsAWS · aws-cli · CVSS 6.8 · 2026-08-03 | 6.8 | 0.5% | 2026-08-03 |
| CVE-2026-89422TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extensionErlang · OTP · CVSS 9.3 · 2026-09-22 | 9.3 | 0.5% | 2026-09-22 |
| CVE-2026-94423Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hostsNo vendor recorded · CVSS 9.1 · 2026-10-21 | 9.1 | 0.4% | 2026-10-21 |
| CVE-2025-20163Cisco Nexus Dashboard Fabric Controller SSH Host Key VulnerabilityCisco · Cisco Data Center Network Manager · CVSS 8.7 · 2025-06-04 | 8.7 | 0.4% | 2025-06-04 |
| CVE-2026-94140Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=noNo vendor recorded · CVSS 9.1 · 2026-10-21 | 9.1 | 0.4% | 2026-10-21 |
| CVE-2025-10966missing SFTP host verification with wolfSSHcurl · curl · CVSS 4.3 · 2025-11-07 | 4.3 | 0.4% | 2025-11-07 |
| CVE-2026-94135Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by defaultApache Software Foundation · Apache Airflow SFTP provider · CVSS 4.3 · 2026-10-15 | 4.3 | 0.4% | 2026-10-15 |
| CVE-2024-47519Backup uploads to ETM subject to man-in-the-middle interceptionArista Networks · Arista Edge Threat Management · CVSS 8.3 · 2025-01-10 | 8.3 | 0.4% | 2025-01-10 |
| CVE-2024-6572Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'Checkmk GmbH · Checkmk · CVSS 7.4 · 2024-09-09 | 7.4 | 0.3% | 2024-09-09 |
| CVE-2021-34433In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server sid…The Eclipse Foundation · Eclipse Californium · 2021-08-20 | – | 0.3% | 2021-08-20 |
| CVE-2026-126641Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabledRed Hat · Red Hat Ansible Automation Platform 2 · CVSS 6.5 · 2026-11-12 | 6.5 | 0.3% | 2026-11-12 |
| CVE-2025-13914Apstra: SSH host key validation vulnerability for managed devicesJuniper Networks · Apstra · CVSS 8.7 · 2026-04-09 | 8.7 | 0.3% | 2026-04-09 |
| CVE-2024-7516Brocade Fabric OS before 9.2.2 does not enforce strict host key checkingBrocade · Fabric OS · CVSS 7 · 2024-11-12 | 7.0 | 0.3% | 2024-11-12 |
| CVE-2026-77703SSH Host Key Verification Bypass in HAVELSAN's Liman Render EngineHAVELSAN Inc. · Liman Render Engine · CVSS 5.9 · 2026-09-24 | 5.9 | 0.2% | 2026-09-24 |
| CVE-2026-11745A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// con…LY Corporation · Central Dogma · CVSS 8.8 · 2026-06-22 | 8.8 | 0.2% | 2026-06-22 |
| CVE-2026-107675FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp ProtocolFFmpeg · FFmpeg · CVSS 5.9 · 2026-10-08 | 5.9 | 0.2% | 2026-10-08 |
| CVE-2026-1354Zero Motorcycles Firmware Key Exchange without Entity AuthenticationZero Motorcycles · Zero Motorcycles firmware · CVSS 6.4 · 2026-04-21 | 6.4 | 0.1% | 2026-04-21 |
| CVE-2026-33697CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keysultravioletrs · cocos · CVSS 7.5 · 2026-03-26 | 7.5 | 0.1% | 2026-03-26 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.