CWE-287: Improper Authentication

Weakness type from the CWE catalogue

What the weakness means

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Definition as published by MITRE, in English.

1,529 vulnerabilities in the service point to this weakness

CVE-2026-49869 Actively exploited Critical 10.0

Kestra OSS OS Command Injection Vulnerability

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public confi…
CVE-2026-20182 Actively exploited Critical 10.0

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. This new advisory is for a new vu…
CVE-2026-20127 Actively exploited Critical 10.0

Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator,…
CVE-2025-32975 Actively exploited Critical 10.0

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an…
CVE-2021-22893 Actively exploited Critical 10.0

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect …
CVE-2026-82329 Actively exploited Critical 9.8

JFrog Artifactory Improper Authentication Vulnerability

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
CVE-2026-65400 Actively exploited Critical 9.8

Apple macOS Improper Authentication Vulnerability

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An …
CVE-2026-16232 Actively exploited Critical 9.8

Check Point SmartConsole Improper Authentication Vulnerability

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with ful…
CVE-2026-46817 Actively exploited Critical 9.8

Oracle E-Business Suite Improper Privilege Management Vulnerability

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allow…
CVE-2025-61882 Actively exploited Critical 9.8

Oracle E-Business Suite Unspecified Vulnerability

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable…
CVE-2024-53704 Actively exploited Critical 9.8

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
CVE-2024-11680 Actively exploited Critical 9.8

ProjectSend Improper Authentication Vulnerability

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, …
CVE-2024-7593 Actively exploited Critical 9.8

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CVE-2024-21410 Actively exploited Critical 9.8

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2023-49105 Actively exploited Critical 9.8

ownCloud Improper Authentication Vulnerability

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no…
CVE-2023-35082 Actively exploited Critical 9.8

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This…
CVE-2023-35078 Actively exploited Critical 9.8

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2023-28461 Actively exploited Critical 9.8

Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header wit…
CVE-2022-40684 Actively exploited Critical 9.8

Fortinet Multiple Products Authentication Bypass Vulnerability

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6…
CVE-2021-33044 Actively exploited Critical 9.8

Dahua IP Camera Authentication Bypass Vulnerability

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVE-2021-33045 Actively exploited Critical 9.8

Dahua IP Camera Authentication Bypass Vulnerability

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
CVE-2021-32030 Actively exploited Critical 9.8

ASUS Routers Improper Authentication Vulnerability

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticat…
CVE-2021-27877 Actively exploited Critical 9.8

Veritas Backup Exec Agent Improper Authentication Vulnerability

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current ve…
CVE-2020-12812 Actively exploited Critical 9.8

Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second fact…
CVE-2020-4427 Actively exploited Critical 9.8

IBM Data Risk Manager Security Bypass Vulnerability

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially craft…

Sources and freshness

CVE

What it is: A reference number naming one specific vulnerability, for example CVE-2024-9474.
What it tells you: Which vulnerability we are talking about, and in which product.
What it does NOT tell you: Nothing about how serious it is, whether anyone is exploiting it, or whether it concerns you.
Why it matters: Without a shared number, vendor, authority and tooling cannot discuss the same flaw.
Used with the others: The number is the key. NVD, KEV and EPSS all describe the same CVE.

NVD CWE CISA KEV EPSS

How to read this together

No single value should be used on its own. A high CVSS score does not mean a vulnerability is being exploited, and a low one does not mean it is harmless. The four sources answer four different questions.

CVE names the specific vulnerability.
NVD adds severity and technical detail about it.
CWE describes the type of mistake behind it.
CISA KEV shows that it is already being exploited.
EPSS estimates how likely exploitation is soon.

The order that decides what is urgent

Do you actually have the product?
Is the version you run affected?
Is it listed in CISA KEV?
Does it have a high EPSS score?
Is the system reachable from the internet or from others?
How important is the system to the business?
Are there compensating controls already in place?

The first two questions are not about the vulnerability at all. They are about you, and they remove most of the list before you start.

A short example

Fix this week

CVSS 6,5 (medium)

In CISA KEV: yes
EPSS: 94 per cent
A firewall facing the internet

Can be scheduled

CVSS 9,8 (critical)

In CISA KEV: no
EPSS: 0,04 per cent
A test server with no internet access

Sorted by CVSS alone, the one on the right comes first. It is the more serious flaw in theory. But the one on the left is being used against real organisations right now, and it sits where an attacker can reach it. That is the one to fix first.

The critical one still has to be fixed. It just does not have to be fixed today.

This product uses the NVD API but is not endorsed or certified by the NVD. CVE and the CVE logo are registered trademarks of The MITRE Corporation; CVE records are used under the CVE Terms of Use. CWE is a trademark of The MITRE Corporation, used per the CWE Terms of Use. KEV data from CISA (CC0). Exploitation probability from EPSS, a FIRST.org project. Open-source package data from OSV and the GitHub Advisory Database (CC-BY 4.0).

Scores and vectors are shown as published by the sources. The ordering of results is Berigo's own editorial assessment, described on the search page, and is not NVD data. An empty result never means a system is safe.