# CWE-308.

Every Advisory and CVE whose sources give the weakness CWE-308, newest first.

## Records, newest first

- [SonicWall SonicOS: An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user…](https://agentprime.io/advisories/CVE-2026-19868.md)
  `CVE-2026-19868` · CVE record: SonicWall SonicOS · CVSS 7.5 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 6 Nov 2026 · Tags: CWE-308
- [Umami 2FA Policy route.ts single-factor authentication](https://agentprime.io/advisories/CVE-2026-121531.md)
  `CVE-2026-121531` · CVE record: Umami · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass, CWE-308
- [Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90862.md)
  `CVE-2026-90862` · CVE record: Progress Software WS_FTP Server · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass, CWE-308
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover](https://agentprime.io/advisories/CVE-2026-111884.md)
  `CVE-2026-111884` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-308
- [FileRise: WebDAV authentication bypasses TOTP/MFA entirely](https://agentprime.io/advisories/CVE-2026-57490.md)
  `CVE-2026-57490` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-308
- [Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)](https://agentprime.io/advisories/GHSA-45gv-9wjv-xh7p.md)
  `GHSA-45gv-9wjv-xh7p`, `CVE-2026-107808`, `GO-2026-6704` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814`, fixed in `1.9.10-0.20260728074558-95cd21b70814` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, CWE-305, CWE-308
- [Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)](https://agentprime.io/advisories/CVE-2026-79763.md)
  `CVE-2026-79763` · CVE record: Termix-SSH Termix · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-308
- [Missing Authentication check in SAP NetWeaver (Message Server)](https://agentprime.io/advisories/CVE-2026-58240.md)
  `CVE-2026-58240` · CVE record: SAP_SE SAP NetWeaver (Message Server) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-308
- [phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable](https://agentprime.io/advisories/CVE-2026-85590.md)
  `CVE-2026-85590` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-308
- [OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration](https://agentprime.io/advisories/CVE-2026-67611.md)
  `CVE-2026-67611` · CVE record: openemr openemr · CVSS 8.6 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-308
- [Local MFA not enforced during SSO sign-in](https://agentprime.io/advisories/CVE-2026-15616.md)
  `CVE-2026-15616` · CVE record: Logto Logto · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-308
- [Webmin MFA bypass](https://agentprime.io/advisories/CVE-2026-56022.md)
  `CVE-2026-56022` · CVE record: Webmin Webmin · CVSS 6.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-308
- [Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password](https://agentprime.io/advisories/CVE-2026-45749.md)
  `CVE-2026-45749` · CVE record: Termix-SSH Termix · CVSS 8.1 High · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-308
- [Vantage6: 2FA can be circumvented with hacked email access](https://agentprime.io/advisories/GHSA-4c5c-2vc3-x5w2.md)
  `GHSA-4c5c-2vc3-x5w2`, `CVE-2024-27928`, `PYSEC-2026-3398` · PyPI `vantage6`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-308
- [Alinto SOGo: SOGo before 5.12.5 does not renew the OTP if a user disables/enables it…](https://agentprime.io/advisories/CVE-2026-33550.md)
  `CVE-2026-33550` · CVE record: Alinto SOGo · CVSS 2.0 Low · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-308
- [A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism.](https://agentprime.io/advisories/CVE-2024-50618.md)
  `CVE-2024-50618` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-308
- [Zitadel May Bypass Second Authentication Factor](https://agentprime.io/advisories/GHSA-cfjq-28r2-4jv5.md)
  `GHSA-cfjq-28r2-4jv5`, `CVE-2025-64103`, `GO-2025-4083` · Go `github.com/zitadel/zitadel` and 1 more: affected `<1.80.0-v2.20.0.20251029091250-b284f8474eed`, fixed in `1.80.0-v2.20.0.20251029091250-b284f8474eed` · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2025 · Tags: Authentication bypass, CWE-308
- [Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476](https://agentprime.io/advisories/CVE-2025-42959.md)
  `CVE-2025-42959` · CVE record: SAP_SE SAP NetWeaver ABAP Server and ABAP Platform · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-308
- [Insecure Authentication Vulnerability](https://agentprime.io/advisories/CVE-2024-47652.md)
  `CVE-2024-47652` · CVE record: Shilpi Computers Client Dashboard · CVSS 7.6 High · Not analysed yet · Published 4 Oct 2024 · Tags: CWE-308
- [IBM Spectrum Virtualize security bypass](https://agentprime.io/advisories/CVE-2023-25681.md)
  `CVE-2023-25681` · CVE record: IBM Spectrum Virtualize · CVSS 5.3 Medium · Not analysed yet · Published 5 Mar 2024 · Tags: CWE-308
- [IBM PowerSC improper authentication](https://agentprime.io/advisories/CVE-2023-50934.md)
  `CVE-2023-50934` · CVE record: IBM PowerSC · CVSS 5.3 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-308
- [Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls](https://agentprime.io/advisories/GHSA-9wwg-r3c7-4vfg.md)
  `GHSA-9wwg-r3c7-4vfg`, `CVE-2023-49075`, `PKSA-yx17-4cq4-3ybs` · Packagist `pimcore/admin-ui-classic-bundle`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 8.5 High · Not analysed yet · Published 27 Nov 2023 · Tags: CWE-308
- [JetBrains TeamCity: In JetBrains TeamCity before 2023.05 authentication checks were missing…](https://agentprime.io/advisories/CVE-2023-34228.md)
  `CVE-2023-34228` · CVE record: JetBrains TeamCity · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2023 · Tags: CWE-308

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-308>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-308/>. Everything for agents: <https://agentprime.io/llms.txt>.