# CWE-289.

Every Advisory and CVE whose sources give the weakness CWE-289, newest first.

## Records, newest first

- [kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion](https://agentprime.io/advisories/GHSA-23vg-4cjm-66q5.md)
  `GHSA-23vg-4cjm-66q5`, `CVE-2026-100351`, `GO-2026-6769` · Go `github.com/getkin/kin-openapi`: affected `>=0.144.0, <0.147.0`, fixed in `0.147.0` · CVSS 7.4 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-289, CWE-436
- [DataEase: Stored SQL Injection via dateFormat field templates](https://agentprime.io/advisories/CVE-2026-104143.md)
  `CVE-2026-104143` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-289
- [social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend](https://agentprime.io/advisories/GHSA-fp7w-m676-w7gc.md)
  `GHSA-fp7w-m676-w7gc`, `CVE-2026-57176`, `PYSEC-2026-4166` · PyPI `social-auth-core`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 6.8 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-289
- [WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-95514.md)
  `CVE-2026-95514` · CVE record: netgsm Netgsm · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-289
- [Apache Tomcat: Bypass of security constraints for WebSocket endpoints](https://agentprime.io/advisories/CVE-2026-76183.md)
  `CVE-2026-76183` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-289
- [Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)](https://agentprime.io/advisories/CVE-2026-73511.md)
  `CVE-2026-73511` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-289, CWE-436
- [AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision](https://agentprime.io/advisories/CVE-2026-92579.md)
  `CVE-2026-92579` · CVE record: WWBN AVideo · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-289
- [Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-12101.md)
  `CVE-2026-12101` · CVE record: IBM Verify Identity Access and 3 more · CVSS 8.1 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-289
- [MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token](https://agentprime.io/advisories/CVE-2026-15980.md)
  `CVE-2026-15980` · CVE record: TangibleWP MyHome Core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-289
- [Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login](https://agentprime.io/advisories/CVE-2026-15985.md)
  `CVE-2026-15985` · CVE record: RadiusTheme Classified Listing - Mobile Number Verification · CVSS 8.1 High · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-289
- [Winter: Broken access control in \`Cms\Controllers\Index\` allows cross-template actions and unauthorized asset uploads](https://agentprime.io/advisories/GHSA-5c4f-9pq9-6c77.md)
  `GHSA-5c4f-9pq9-6c77`, `CVE-2026-32639`, `PKSA-m75m-ptnr-6hhr` · Packagist `winter/wn-cms-module`: affected `<1.2.13`, fixed in `1.2.13` · CVSS 6.8 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-280, CWE-289
- [WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT](https://agentprime.io/advisories/CVE-2026-8457.md)
  `CVE-2026-8457` · CVE record: WPWeb WooCommerce - Social Login · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2026 · Tags: CWE-289
- [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability](https://agentprime.io/advisories/CVE-2026-10842.md)
  `CVE-2026-10842` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-289
- [Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation](https://agentprime.io/advisories/CVE-2026-9701.md)
  `CVE-2026-9701` · CVE record: joe007 Eventer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-289
- [Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass](https://agentprime.io/advisories/GHSA-9r87-mvcw-x35f.md)
  `GHSA-9r87-mvcw-x35f`, `CVE-2026-55075`, `GO-2026-5908` · Go `github.com/coder/coder/v2`: affected `<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 7.4 High · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, CWE-289
- [node: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling…](https://agentprime.io/advisories/CVE-2026-48618.md)
  `CVE-2026-48618` · CVE record: nodejs node · CVSS 7.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-176, CWE-289
- [Apache Shiro shiro-guice module vulnerable to authentication bypass](https://agentprime.io/advisories/GHSA-qj64-jj84-w38j.md)
  `GHSA-qj64-jj84-w38j`, `CVE-2026-56091` · Maven `org.apache.shiro:shiro-guice`: affected `>=2.0.0, <3.0.0`, fixed in `3.0.0` · CVSS 8.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-289
- [Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts](https://agentprime.io/advisories/GHSA-9cr8-q42q-g8m7.md)
  `GHSA-9cr8-q42q-g8m7`, `CVE-2026-53622`, `GO-2026-5287` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Authentication bypass, CWE-289
- [Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator](https://agentprime.io/advisories/GHSA-9mrv-8pvf-hf4m.md)
  `GHSA-9mrv-8pvf-hf4m`, `CVE-2026-50627` · Maven `org.apache.cxf:cxf-rt-rs-security-oauth2`: affected `>=4.2.0, <4.2.2 || <4.1.7`, fixed in `4.2.2`, `4.1.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: Authentication bypass, CWE-289
- [axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)](https://agentprime.io/advisories/GHSA-pjwm-pj3p-43mv.md)
  `GHSA-pjwm-pj3p-43mv`, `CVE-2026-44492` · npm `axios`: affected `<0.32.0 || >=1.15.0, <1.16.0`, fixed in `0.32.0`, `1.16.0` · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF), CWE-289
- [Rsync < 3.4.3 Authorization Bypass via Hostname Resolution](https://agentprime.io/advisories/CVE-2026-43617.md)
  `CVE-2026-43617` · CVE record: RsyncProject rsync · CVSS 6.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-289
- [Traefik: Pre-authentication decision bypass due to forwarded alias spoofing](https://agentprime.io/advisories/GHSA-5m6w-wvh7-57vm.md)
  `GHSA-5m6w-wvh7-57vm`, `CVE-2026-39858`, `GO-2026-5149` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: Authentication bypass, CWE-289
- [Util-linux: util-linux: access control bypass due to improper hostname canonicalization](https://agentprime.io/advisories/CVE-2026-3184.md)
  `CVE-2026-3184` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 3.7 Low · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-289
- [OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty](https://agentprime.io/advisories/GHSA-g7cr-9h7q-4qxq.md)
  `GHSA-g7cr-9h7q-4qxq`, `CVE-2026-34506` · npm `openclaw`: affected `<2026.3.8`, fixed in `2026.3.8` · CVSS 2.3 Low · Not analysed yet · Published 12 Mar 2026 · Tags: Broken access control, CWE-289
- [OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths](https://agentprime.io/advisories/GHSA-mwxv-35wr-4vvj.md)
  `GHSA-mwxv-35wr-4vvj`, `CVE-2026-32036` · npm `openclaw`: affected `<2026.2.26`, fixed in `2026.2.26` · CVSS 8.3 High · Not analysed yet · Published 3 Mar 2026 · Tags: Path traversal, CWE-289
- [Apache Shiro has an Authentication Bypass](https://agentprime.io/advisories/GHSA-c244-p6m5-vqj6.md)
  `GHSA-c244-p6m5-vqj6`, `CVE-2026-23903` · Maven `org.apache.shiro:shiro-spring`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-289
- [Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve](https://agentprime.io/advisories/GHSA-pchf-49fh-w34r.md)
  `GHSA-pchf-49fh-w34r`, `CVE-2026-24058`, `GO-2026-4353` · Go `github.com/charmbracelet/soft-serve`: affected `<0.11.3`, fixed in `0.11.3` · CVSS 8.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-289
- [node: A flaw in Node.js’s Permissions model allows attackers to bypass \`--allow-fs-read\` and…](https://agentprime.io/advisories/CVE-2025-55130.md)
  `CVE-2025-55130` · CVE record: nodejs node · CVSS 7.1 High · Not analysed yet · Published 20 Jan 2026 · Tags: CWE-281, CWE-289
- [Keycloak: keycloak idor in realm client creating/deleting](https://agentprime.io/advisories/CVE-2025-14777.md)
  `CVE-2025-14777` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-289
- [Elated Membership <= 1.2 - Authentication Bypass via Social Login](https://agentprime.io/advisories/CVE-2025-13613.md)
  `CVE-2025-13613` · CVE record: Elated Themes Elated Membership · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2025 · Tags: CWE-289
- [authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service accou...](https://agentprime.io/advisories/GHSA-xr73-jq5p-ch8r.md)
  `GHSA-xr73-jq5p-ch8r`, `BIT-authentik-2025-64521`, `CVE-2025-64521`, `GO-2025-4137`, `PYSEC-2025-237` · PyPI `authentik-client`: affected `>=2025.8.0, <2025.8.5 || >=2025.10.0, <2025.10.2`, fixed in `2025.8.5`, `2025.10.2` · CVSS 4.8 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: CWE-289
- [(conda) Constructor: Excessive permissions during and after installation](https://agentprime.io/advisories/CVE-2025-64343.md)
  `CVE-2025-64343` · CVE record: conda constructor · CVSS 7.8 High · Not analysed yet · Published 7 Nov 2025 · Tags: CWE-289
- [The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation.](https://agentprime.io/advisories/CVE-2025-60375.md)
  `CVE-2025-60375` · CVE record · CVSS 7.3 High · Not analysed yet · Published 9 Oct 2025 · Tags: CWE-289
- [Spring Security annotation detection mechanism has authorization bypass](https://agentprime.io/advisories/GHSA-8v5q-rhf3-jphm.md)
  `GHSA-8v5q-rhf3-jphm`, `CVE-2025-41248` · Maven `org.springframework.security:spring-security-core`: affected `>=6.4.0, <6.4.10 || >=6.5.0, <6.5.4`, fixed in `6.4.10`, `6.5.4` · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2025 · Tags: Broken access control, CWE-289
- [Cryostat: authentication bypass if network policies are disabled](https://agentprime.io/advisories/CVE-2025-8415.md)
  `CVE-2025-8415` · CVE record: Cryostat Cryostat and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-289
- [Unraid: Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console…](https://agentprime.io/advisories/CVE-2025-29266.md)
  `CVE-2025-29266` · CVE record: Unraid Unraid · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-289
- [WP JobHunt <= 7.1 - Authentication Bypass to Candidate](https://agentprime.io/advisories/CVE-2024-11283.md)
  `CVE-2024-11283` · CVE record: WP JobHunt · CVSS 7.5 High · Not analysed yet · Published 14 Mar 2025 · Tags: CWE-289
- [DataEase has an unauthorized vulnerability](https://agentprime.io/advisories/CVE-2024-56511.md)
  `CVE-2024-56511` · CVE record: dataease dataease · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.50 · Not analysed yet · Published 10 Jan 2025 · Tags: CWE-289
- [Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.](https://agentprime.io/advisories/GHSA-7cwc-fjqm-8vh8.md)
  `GHSA-7cwc-fjqm-8vh8`, `BIT-drupal-2024-55634`, `CVE-2024-55634`, `DRUPAL-CORE-2024-004`, `PKSA-bnz1-mtnt-3dxx`, `PKSA-ts55-c66h-g96n`, `PKSA-vt8m-56zm-d92y` · Packagist `drupal/core`: affected `>=8.0.0, <10.2.11 || >=10.3.0, <10.3.9 || >=11.0.0, <11.0.8`, fixed in `10.2.11`, `10.3.9`, `11.0.8` · CVSS 8.1 High · Not analysed yet · Published 20 Nov 2024 · Tags: CWE-178, CWE-289
- [Moodle Lesson activity password bypass through PHP loose comparison](https://agentprime.io/advisories/GHSA-xfv7-h2qg-rjm7.md)
  `GHSA-xfv7-h2qg-rjm7`, `BIT-moodle-2024-45691`, `CVE-2024-45691`, `PKSA-y22b-yrq9-2frq` · Packagist `moodle/moodle`: affected `<4.1.13 || >=4.2.0-beta, <4.2.10 || >=4.3.0-beta, <4.3.7 || >=4.4.0-beta, <4.4.3`, fixed in `4.1.13`, `4.2.10`, `4.3.7`, `4.4.3` · CVSS 5.4 Medium · Not analysed yet · Published 20 Nov 2024 · Tags: Broken access control, CWE-289
- [Symfony has an Authentication Bypass via RememberMe](https://agentprime.io/advisories/GHSA-cg23-qf8f-62rr.md)
  `GHSA-cg23-qf8f-62rr`, `CVE-2024-51996`, `PKSA-rqvm-b18n-vg69`, `PKSA-yvfh-tnnw-3w9h` · Packagist `symfony/security-http`: affected `>=5.3.0, <5.4.47 || >=6.0.0-BETA1, <6.4.15 || >=7.0.0-BETA1, <7.1.8`, fixed in `5.4.47`, `6.4.15`, `7.1.8` · CVSS 7.5 High · Not analysed yet · Published 13 Nov 2024 · Tags: Authentication bypass, CWE-289
- [Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary](https://agentprime.io/advisories/CVE-2024-2098.md)
  `CVE-2024-2098` · CVE record: codename065 Download Manager · CVSS 7.5 High · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-289
- [Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367.](https://agentprime.io/advisories/CVE-2024-34519.md)
  `CVE-2024-34519` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 5 May 2024 · Tags: CWE-289
- [Hail relies on OIDC email claims to verify the validity of a user's domain.](https://agentprime.io/advisories/GHSA-487p-qx68-5vjw.md)
  `GHSA-487p-qx68-5vjw`, `CVE-2023-51663`, `PYSEC-2023-271` · PyPI `hail`: affected `<0.2.127`, fixed in `0.2.127` · CVSS 5.3 Medium · Not analysed yet · Published 2 Jan 2024 · Tags: CWE-289
- [Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation](https://agentprime.io/advisories/GHSA-fv2h-753j-9g39.md)
  `GHSA-fv2h-753j-9g39`, `CVE-2023-41890` · NuGet `Kentor.AuthServices` and 1 more: affected `<=0.23.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 20 Sept 2023 · Tags: Authentication bypass, CWE-289
- [Dataprobe iBoot PDU: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable…](https://agentprime.io/advisories/CVE-2023-3263.md)
  `CVE-2023-3263` · CVE record: Dataprobe iBoot PDU · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2023 · Tags: CWE-289
- [HedgeDoc API allows to hide existing notes](https://agentprime.io/advisories/CVE-2023-38487.md)
  `CVE-2023-38487` · CVE record: hedgedoc hedgedoc · CVSS 6.5 Medium · Not analysed yet · Published 4 Aug 2023 · Tags: CWE-289
- [A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.](https://agentprime.io/advisories/CVE-2023-20046.md)
  `CVE-2023-20046` · CVE record: Cisco Cisco ASR 5000 Series Software and 1 more · CVSS 8.8 High · Not analysed yet · Published 9 May 2023 · Tags: CWE-289
- [Authentication Bypass in Redline Router](https://agentprime.io/advisories/CVE-2023-1803.md)
  `CVE-2023-1803` · CVE record: DTS Electronics Redline Router · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2023 · Tags: CWE-289
- [Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata](https://agentprime.io/advisories/GHSA-3633-5h82-39pq.md)
  `GHSA-3633-5h82-39pq`, `GO-2022-1004` · Go `github.com/theupdateframework/go-tuf`: affected `<0.3.2`, fixed in `0.3.2` · No CVSS score · Not analysed yet · Published 16 Sept 2022 · Tags: CWE-289
- [Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2021-34746.md)
  `CVE-2021-34746` · CVE record: Cisco Cisco Enterprise NFV Infrastructure Software · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 2 Sept 2021 · Tags: CWE-289
- [Authentication Bypass by Alternate Name in Apache Tomcat](https://agentprime.io/advisories/GHSA-36qh-35cm-5w2w.md)
  `GHSA-36qh-35cm-5w2w`, `BIT-tomcat-2021-30640`, `CVE-2021-30640` · Maven `org.apache.tomcat:tomcat`: affected `>=10.0.0-M1, <10.0.5 || >=9.0.0M1, <9.0.45 || >=8.5.0, <8.5.65`, fixed in `10.0.5`, `9.0.45`, `8.5.65` · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2021 · Tags: Authentication bypass, CWE-116, CWE-289
- [NetGain Systems Enterprise Manager: This vulnerability allows remote attackers to bypass authentication on vulnerable…](https://agentprime.io/advisories/CVE-2017-16590.md)
  `CVE-2017-16590` · CVE record: NetGain Systems NetGain Systems Enterprise Manager · No CVSS score · Not analysed yet · Published 23 Jan 2018 · Tags: CWE-289

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-289>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-289/>. Everything for agents: <https://agentprime.io/llms.txt>.