Advisories · Weakness
CWE-308.
Every Advisory and CVE whose sources give the weakness CWE-308, newest first.
- CVSS 5.3 Medium
Umami 2FA Policy route.ts single-factor authentication
- Umami
- Authentication bypass
- CWE-308
- CVSS 4.3 Medium
Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
- Progress Software WS_FTP Server
- Authentication bypass
- CWE-308
- CVSS 8.7 High
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
- thorsten phpMyFAQ
- CWE-308
- CVSS 8.1 High
FileRise: WebDAV authentication bypasses TOTP/MFA entirely
- error311 FileRise
- CWE-308
- CVSS 8.1 High
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
- Authentication bypass
- CWE-305
>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074558-95cd21b70814 · fixed in 1.9.10-0.20260728074558-95cd21b70814
GHSA-45gv-9wjv-xh7p · CVE-2026-107808 - CVSS 5.3 Medium
Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)
- Termix
- CWE-308
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing Authentication check in SAP NetWeaver (Message Server)
- SAP_SE SAP NetWeaver (Message Server)
- CWE-308
- CVSS 7.1 High
phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
- thorsten phpMyFAQ
- CWE-308
- CVSS 8.6 High
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
- openemr
- CWE-308
- CVSS 9.1 CriticalCritical · CVSS 9+
Local MFA not enforced during SSO sign-in
- Logto
- CWE-308
- CVSS 6.9 Medium
Webmin MFA bypass
- Webmin
- CWE-308
- CVSS 8.1 High
Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
- Termix
- CWE-308
- CVSS 5.9 Medium
Vantage6: 2FA can be circumvented with hacked email access
- CWE-308
<5.0.0 · fixed in 5.0.0
GHSA-4c5c-2vc3-x5w2 · CVE-2024-27928 - CVSS 2.0 Low
Alinto SOGo: SOGo before 5.12.5 does not renew the OTP if a user disables/enables it…
- Alinto SOGo
- CWE-308
- CVSS 4.3 Medium
A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection mechanism.
- CWE-308
- CVSS 8.7 High
Zitadel May Bypass Second Authentication Factor
- Authentication bypass
- CWE-308
<1.80.0-v2.20.0.20251029091250-b284f8474eed · fixed in 1.80.0-v2.20.0.20251029091250-b284f8474eed
GHSA-cfjq-28r2-4jv5 · CVE-2025-64103 - CVSS 8.1 High
Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
- SAP_SE SAP NetWeaver ABAP Server and ABAP Platform
- CWE-308
- CVSS 7.6 High
Insecure Authentication Vulnerability
- Shilpi Computers Client Dashboard
- CWE-308
- CVSS 5.3 Medium
IBM Spectrum Virtualize security bypass
- IBM Spectrum Virtualize
- CWE-308
- CVSS 5.3 Medium
IBM PowerSC improper authentication
- IBM PowerSC
- CWE-308
- CVSS 8.5 High
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
- CWE-308
<1.2.2 · fixed in 1.2.2
GHSA-9wwg-r3c7-4vfg · CVE-2023-49075 - CVSS 5.3 Medium
JetBrains TeamCity: In JetBrains TeamCity before 2023.05 authentication checks were missing…
- JetBrains TeamCity
- CWE-308