CWE-305.

Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• CWE-305

Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

• Apache Software Foundation Apache Qpid Proton C
• CWE-305

Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

• BMC Control-M/Enterprise Manager
• BMC Control-M/Server
• CWE-305

WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

• VideoWhisper.com 2Way VideoCalls and Random Chat
• CWE-305

BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

• BMC Helix Network Management
• CWE-305

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

• Authentication bypass
• CWE-305

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814 · fixed in 1.9.10-0.20260728074558-95cd21b70814

Gitea built-in SSH server authentication bypass through key case folding

• Gitea
• CWE-305

Apache MINA SSHD: Asynchronous authentication can bypass signature verification

• Apache Software Foundation Apache MINA SSHD
• CWE-305

Apache MINA SSHD: LDAP injection in sshd-ldap

• Apache Software Foundation Apache MINA SSHD
• Other injection
• CWE-305

HMAC Confirmation Token Unbinding in zscaler-mcp-server

• zscaler-mcp-server
• CWE-305

Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

• Red Hat Hardened Images
• CWE-305

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

• CWE-305

>=4.3.8, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Authentication bypass leads to unauthorised access to N-central

• N-able N-central
• CWE-305

PaperCut MF/NG: Authentication Bypass

• PaperCut MF/NG
• CWE-305

Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

• Rapid7 Metasploit-framework
• CWE-305

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically

• CWE-305
• CWE-1025

Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user

• Apache Software Foundation Apache Hive
• Authentication bypass
• CWE-305

Admin Account Takeover via Path Traversal in vsDesk

• vsDesk
• CWE-305

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO sessi…

• CWE-305
• CWE-628

Register Bypass in Universal Sotware's E-Municipality

• Universal Software Inc. E-Municipality
• CWE-305

Bypassing passkey entry in legacy pairing

• silabs.com WiseConnect
• CWE-305

Bluetooth re-pairing with legitimate device can use lower security level

• silabs.com WiseConnect
• CWE-305

sysctl and platform-op locks open to abuse

• Xen
• Broken access control
• CWE-305

Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-305
• CWE-841

Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint

• Mattermost
• CWE-305

Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost

• Mattermost
• CWE-305

Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability.

• Dell Inspiron 15 3520
• Dell G15 5530
• CWE-305

incomplete mTLS config matching in conn reuse

• curl
• CWE-305

Rancher has Privilege Escalation from Project Owner to Host

• CWE-305

<0.0.0-20260513182521-2800aaac25b5 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.6 || >=2.14.0, <2.14.2 · fixed in 0.0.0-20260513182521-2800aaac25b5, 2.12.10, 2.13.6, 2.14.2

Unauthenticated command injection in Control-M/Server communication command

• BMC Control-M/Server
• CWE-305

Authentication Bypass for SafeLine SL6 and SL6+

• SafeLine SL6/SL6+
• CWE-305

Freelance Security Lock – Access to Windows OS

• ABB Freelance
• CWE-305

OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header

• openbullet2
• CWE-305

Keycloak has an Authentication Bypass by Primary Weakness

• CWE-305

<=26.4.7 || >=26.5.0, <=26.6.4 · no fixed version yet

Devolutions Server: Improper handling of factor key state in the multi-factor authentication management…

• Devolutions Server
• CWE-305

Missing exit out of permission check in haveged could lead to root exploit

• Container suse/sle-micro-rancher/5.3:latest
• Container suse/sle-micro-rancher/5.4:latest
• CWE-305

Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow

• CWE-305

<5.3.2-0.20260318173148-e9ae890a013b · fixed in 5.3.2-0.20260318173148-e9ae890a013b

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) ...

• CWE-305

<3.10.0 · fixed in 3.10.0

wrong reuse of HTTP Negotiate connection

• curl
• CWE-305

Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-305

Improper Authentication vulnerability in Progress MOVEit Automation

• Progress Software MOVEit Automation
• CWE-305

Spring Boot's default security filter chain has no authorization rule with Actuator but without Health

• Broken access control
• CWE-305

>=4.0.0, <4.0.6 · fixed in 4.0.6

ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout

• CRM
• Authentication bypass
• CWE-305

Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)

• cryptomator
• Weak cryptography or TLS
• CWE-305

Cisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability

• Cisco Secure Web Appliance
• CWE-305

Siemens Industrial Edge Management Pro V1: A vulnerability has been identified in Industrial Edge Management Pro V1 (All versions >=…

• Siemens Industrial Edge Management Pro V1
• Siemens Industrial Edge Management Pro V2
• CWE-305

Pachno 1.0.6 Open Redirection via return_to Parameter

• Pachno
• CWE-305

A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass

• ISC BIND 9
• CWE-305
• CWE-562

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

• CWE-305

<2.28.1 · fixed in 2.28.1

Ory Oathkeeper has an authentication bypass by cache key confusion

• CWE-305
• CWE-1289

<0.40.10-0.20260320084801-198a2bc82a99 · fixed in 0.40.10-0.20260320084801-198a2bc82a99

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

• Authentication bypass
• CWE-305

<4.28.0 · fixed in 4.28.0

A vulnerability found in Dahua NVR/XVR device.

• dahua NVR2-4KS3
• dahua XVR4232AN-I/T
• CWE-305

wrong proxy connection reuse with credentials

• curl
• CWE-305

bad reuse of HTTP Negotiate connection

• curl
• CWE-305

Keycloak SAML Broken has Authentication Bypass by Primary Weakness

• CWE-305

<=1.8.1.Final · no fixed version yet

Authentication bypass vulnerability in the device authentication module.

• Huawei HarmonyOS
• CWE-305

IBM MQ is affected by an authority vulnerablility

• IBM MQ
• CWE-305

Application User custom defined accounts are not properly password protected in Brocade ASCG 3.4.0

• Brocade ASCG
• CWE-305

Fortinet FortiOS: An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in…

• Fortinet FortiOS
• CWE-305

Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2a

• Brocade Fabric OS
• CWE-305