CWE-836 · Authentication
Use of Password Hash Instead of Password for Authentication
16CVEs
SortMost likely exploited
16 CVEs with CWE-836 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-7927A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX…Dahuasecurity · Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras · 2017-05-06 | – | 37% | 2017-05-06 |
| CVE-2023-34132Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlie…SonicWall · GMS · 2023-07-13 | – | 7.7% | 2023-07-13 |
| CVE-2022-32282An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use i…WWBN · AVideo · CVSS 7.2 · 2022-08-22 | 7.2 | 1.9% | 2022-08-22 |
| CVE-2021-23857Login with hashRexroth · IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22, XM41 and XM42 IndraMotion… · CVSS 10 · 2021-10-04 | 10.0 | 1.2% | 2021-10-04 |
| CVE-2023-23614Improper session handling of "Remember me for 7 days" functionalitypi-hole · AdminLTE · CVSS 8.8 · 2023-01-26 | 8.8 | 1.0% | 2023-01-26 |
| CVE-2023-23450Use of Password Hash Instead of Password for Authentication in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an u…SICK AG · SICK FTMG-ESD15AXX AIR FLOW SENSOR · CVSS 6.2 · 2023-05-15 | 6.2 | 0.7% | 2023-05-15 |
| CVE-2023-4299Digi RealPort Protocol Use of Password Hash Instead of Password for AuthenticationDigi International · Digi RealPort · CVSS 9 · 2023-08-31 | 9.0 | 0.7% | 2023-08-31 |
| CVE-2023-39546CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a att…NEC Corporation · CLUSTERPRO X (EXPRESSCLUSTER X) · 2023-11-17 | – | 0.6% | 2023-11-17 |
| CVE-2019-25552CEWE PHOTO SHOW 6.4.3 Denial of Service via Password FieldCewe-Photoworld · CEWE PHOTO SHOW · CVSS 7.5 · 2026-03-21 | 7.5 | 0.4% | 2026-03-21 |
| CVE-2026-9222Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authenticationShenzhen i365-Tech Co. Ltd. · Setracker2 Parental Control App (Android) package com.tgelec.setracker · CVSS 8.1 · 2026-06-25 | 8.1 | 0.4% | 2026-06-25 |
| CVE-2026-63158Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via CookiesOmnispace · Agora Project · CVSS 7.4 · 2026-10-13 | 7.4 | 0.4% | 2026-10-13 |
| CVE-2025-64471A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWe…Fortinet · FortiWeb · CVSS 4.4 · 2025-12-09 | 4.4 | 0.4% | 2025-12-09 |
| CVE-2025-52543Login to the application services using only the password hashCopeland LP · E3 Supervisory Control · CVSS 5.3 · 2025-09-02 | 5.3 | 0.3% | 2025-09-02 |
| CVE-2025-48925The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.TeleMessage · service · CVSS 4.3 · 2025-05-28 | 4.3 | 0.3% | 2025-05-28 |
| CVE-2026-40103Vikunja's Scoped API tokens with projects.background permission can delete project backgroundsgo-vikunja · vikunja · CVSS 4.3 · 2026-04-10 | 4.3 | 0.2% | 2026-04-10 |
| CVE-2026-111248Apache TomEE: Authentication with the stored password digest in Tomcat user identity storeApache Software Foundation · Apache TomEE · 2026-11-10 | – | 0.1% | 2026-11-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.