CWE-289.

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

• CWE-289
• CWE-436

>=0.144.0, <0.147.0 · fixed in 0.147.0

DataEase: Stored SQL Injection via dateFormat field templates

• dataease
• CWE-289

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

• CWE-289

<5.0.0 · fixed in 5.0.0

WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

• Netgsm
• CWE-289

Apache Tomcat: Bypass of security constraints for WebSocket endpoints

• Apache Software Foundation Apache Tomcat
• CWE-289

Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

• envoy
• CWE-289
• CWE-436

AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision

• WWBN AVideo
• CWE-289

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access
• IBM Security Verify Access
• CWE-289

MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

• TangibleWP MyHome Core
• CWE-289

Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

• RadiusTheme Classified Listing - Mobile Number Verification
• CWE-289

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

• CWE-280
• CWE-289

<1.2.13 · fixed in 1.2.13

WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

• WPWeb WooCommerce - Social Login
• CWE-289

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability

• IBM WebSphere Application Server
• IBM WebSphere Application Server - Liberty
• CWE-289

Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

• joe007 Eventer
• CWE-289

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

• Authentication bypass
• CWE-289

<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

node: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling…

• node
• CWE-176
• CWE-289

Apache Shiro shiro-guice module vulnerable to authentication bypass

• CWE-289

>=2.0.0, <3.0.0 · fixed in 3.0.0

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

• Authentication bypass
• CWE-289

<=1.7.34 · no fixed version yet

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

• Authentication bypass
• CWE-289

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

• Server-side request forgery (SSRF)
• CWE-289

<0.32.0 || >=1.15.0, <1.16.0 · fixed in 0.32.0, 1.16.0

Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

• rsync
• CWE-289

Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

• Authentication bypass
• CWE-289

<=1.7.34 · no fixed version yet

Util-linux: util-linux: access control bypass due to improper hostname canonicalization

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-289

OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

• Broken access control
• CWE-289

<2026.3.8 · fixed in 2026.3.8

OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths

• Path traversal
• CWE-289

<2026.2.26 · fixed in 2026.2.26

Apache Shiro has an Authentication Bypass

• CWE-289

<2.1.0 · fixed in 2.1.0

Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve

• CWE-289

<0.11.3 · fixed in 0.11.3

node: A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and…

• node
• CWE-281
• CWE-289

Keycloak: keycloak idor in realm client creating/deleting

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.11
• CWE-289

Elated Membership <= 1.2 - Authentication Bypass via Social Login

• Elated Themes Elated Membership
• CWE-289

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service accou...

• CWE-289

>=2025.8.0, <2025.8.5 || >=2025.10.0, <2025.10.2 · fixed in 2025.8.5, 2025.10.2

(conda) Constructor: Excessive permissions during and after installation

• conda constructor
• CWE-289

The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation.

• CWE-289

Spring Security annotation detection mechanism has authorization bypass

• Broken access control
• CWE-289

>=6.4.0, <6.4.10 || >=6.5.0, <6.5.4 · fixed in 6.4.10, 6.5.4

Cryostat: authentication bypass if network policies are disabled

• Cryostat
• Red Hat Cryostat 4 on RHEL 9
• CWE-289

Unraid: Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console…

• Unraid
• CWE-289

WP JobHunt <= 7.1 - Authentication Bypass to Candidate

• WP JobHunt
• CWE-289

DataEase has an unauthorized vulnerability

• dataease
• CWE-289

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.

• CWE-178
• CWE-289

>=8.0.0, <10.2.11 || >=10.3.0, <10.3.9 || >=11.0.0, <11.0.8 · fixed in 10.2.11, 10.3.9, 11.0.8

Moodle Lesson activity password bypass through PHP loose comparison

• Broken access control
• CWE-289

<4.1.13 || >=4.2.0-beta, <4.2.10 || >=4.3.0-beta, <4.3.7 || >=4.4.0-beta, <4.4.3 · fixed in 4.1.13, 4.2.10, 4.3.7, 4.4.3

Symfony has an Authentication Bypass via RememberMe

• Authentication bypass
• CWE-289

>=5.3.0, <5.4.47 || >=6.0.0-BETA1, <6.4.15 || >=7.0.0-BETA1, <7.1.8 · fixed in 5.4.47, 6.4.15, 7.1.8

Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary

• codename065 Download Manager
• CWE-289

Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367.

• CWE-289

Hail relies on OIDC email claims to verify the validity of a user's domain.

• CWE-289

<0.2.127 · fixed in 0.2.127

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

• Authentication bypass
• CWE-289

<=0.23.0 · no fixed version yet

Dataprobe iBoot PDU: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable…

• Dataprobe iBoot PDU
• CWE-289

HedgeDoc API allows to hide existing notes

• hedgedoc
• CWE-289

A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.

• Cisco ASR 5000 Series Software
• Cisco Ultra Cloud Core - User Plane Function
• CWE-289

Authentication Bypass in Redline Router

• DTS Electronics Redline Router
• CWE-289

Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

• CWE-289

<0.3.2 · fixed in 0.3.2

Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability

• Cisco Enterprise NFV Infrastructure Software
• CWE-289

Authentication Bypass by Alternate Name in Apache Tomcat

• Authentication bypass
• CWE-116

>=10.0.0-M1, <10.0.5 || >=9.0.0M1, <9.0.45 || >=8.5.0, <8.5.65 · fixed in 10.0.5, 9.0.45, 8.5.65

NetGain Systems Enterprise Manager: This vulnerability allows remote attackers to bypass authentication on vulnerable…

• NetGain Systems Enterprise Manager
• CWE-289