Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

CVEs (84)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-0605 1Gitlab 1Gitlab Jun 17, 2026 May 22, 2025 N/A· v4 4.3 MEDIUM· v3 N/A· v2 An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authenticat...Show more An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Group access controls could allow certain users to bypass two-factor authentication requirements.Show less
CVE-2025-32885 1Gotenna 2Gotenna Mesh Firmware Jun 17, 2026 May 1, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined...Show more An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The app there makes it possible to inject any custom message (into existing v1 networks) with any GID and Callsign via a software defined radio. This can be exploited if the device is being used in an unencrypted environment or if the cryptography has already been compromised.Show less
CVE-2025-39596 - - Jun 17, 2026 Apr 17, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Weak Authentication vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows Privilege Escalation.This issue affects Quentn WP: from n/a through <= 1.2.8.
CVE-2025-27740 1Microsoft 7Windows Server 2008 Windows Server 2012Windows Server 2016+4 more Jun 17, 2026 Apr 8, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 Weak authentication in Windows Active Directory Certificate Services allows an authorized attacker to elevate privileges over a network.
CVE-2025-26635 1Microsoft 8Windows 10 1809 Windows 10 21h2Windows 10 22h2+5 more Jun 17, 2026 Apr 8, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.
CVE-2024-54092 - - Jun 17, 2026 Apr 8, 2025 9.3 CRITICAL· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial...Show more A vulnerability has been identified in Industrial Edge Device Kit - arm64 V1.17 (All versions), Industrial Edge Device Kit - arm64 V1.18 (All versions), Industrial Edge Device Kit - arm64 V1.19 (All versions), Industrial Edge Device Kit - arm64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - arm64 V1.21 (All versions < V1.21.1-1), Industrial Edge Device Kit - x86-64 V1.17 (All versions), Industrial Edge Device Kit - x86-64 V1.18 (All versions), Industrial Edge Device Kit - x86-64 V1.19 (All versions), Industrial Edge Device Kit - x86-64 V1.20 (All versions < V1.20.2-1), Industrial Edge Device Kit - x86-64 V1.21 (All versions < V1.21.1-1), Industrial Edge Own Device (IEOD) (All versions < V1.21.1-1-a), Industrial Edge Virtual Device (All versions < V1.21.1-1-a), SCALANCE LPE9413 (6GK5998-3GS01-2AC2) (All versions < V2.1), SIMATIC IPC BX-39A Industrial Edge Device (All versions < V3.0), SIMATIC IPC BX-59A Industrial Edge Device (All versions < V3.0), SIMATIC IPC127E Industrial Edge Device (All versions < V3.0), SIMATIC IPC227E Industrial Edge Device (All versions < V3.0), SIMATIC IPC427E Industrial Edge Device (All versions < V3.0), SIMATIC IPC847E Industrial Edge Device (All versions < V3.0). Affected devices do not properly enforce user authentication on specific API endpoints when identity federation is used. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that identity federation is currently or has previously been used and the attacker has learned the identity of a legitimate user.Show less
CVE-2024-45551 1Qualcomm 240Aqt1000 Firmware Ar8035 FirmwareCsra6620 Firmware+237 more Jun 17, 2026 Apr 7, 2025 N/A· v4 6.2 MEDIUM· v3 N/A· v2 Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
CVE-2025-29991 - - Jun 17, 2026 Apr 3, 2025 N/A· v4 2.2 LOW· v3 N/A· v2 Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two...Show more Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.Show less
CVE-2025-31676 1Email Tfa Project 1Email Tfa Jun 17, 2026 Mar 31, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
CVE-2025-29994 - - Jun 17, 2026 Mar 13, 2025 8.2 HIGH· v4 N/A· v3 N/A· v2 This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipula...Show more This vulnerability exists in the CAP back office application due to improper authentication check at the API endpoint. An unauthenticated remote attacker with a valid login ID could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to other user accounts.Show less
CVE-2025-24070 1Microsoft 2Asp.net Core Visual Studio 2022 Jun 17, 2026 Mar 11, 2025 N/A· v4 7.0 HIGH· v3 N/A· v2 Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-1293 1Hashicorp 1Hermes Jun 17, 2026 Feb 20, 2025 N/A· v4 8.2 HIGH· v3 N/A· v2 Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
CVE-2024-52541 1Dell 392Alienware M15 R6 Firmware Alienware M15 R7 FirmwareAlienware M16 R1 Firmware+389 more Jun 17, 2026 Feb 19, 2025 N/A· v4 8.2 HIGH· v3 N/A· v2 Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVE-2025-1387 1Learningdigital 1Orca Hcm Jun 17, 2026 Feb 17, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.
CVE-2025-26343 1Q Free 1Maxtime Jun 17, 2026 Feb 12, 2025 N/A· v4 8.1 HIGH· v3 N/A· v2 A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP req...Show more A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.Show less
CVE-2025-23058 1Arubanetworks 1Clearpass Policy Manager Jun 17, 2026 Feb 4, 2025 N/A· v4 8.1 HIGH· v3 N/A· v2 A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions th...Show more A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges.Show less
CVE-2025-21552 1Oracle 1Jd Edwards Enterpriseone Orchestrator Jun 17, 2026 Jan 21, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerabil...Show more Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).Show less
CVE-2024-50563 1Fortinet 4Fortianalyzer Fortianalyzer CloudFortimanager+1 more Jun 17, 2026 Jan 16, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 th...Show more A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.Show less
CVE-2024-48886 1Fortinet 6Fortianalyzer Fortianalyzer CloudFortimanager+3 more Jun 17, 2026 Jan 14, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17...Show more A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.Show less
CVE-2024-13239 1Two Factor Authentication Project 1Two Factor Authentication Jun 17, 2026 Jan 9, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.

Previous 1 234 5 Next