# CWE-592.

Every Advisory and CVE whose sources give the weakness CWE-592, newest first.

## Records, newest first

- [Apache Tomcat - Digest authenticator will authenticate any unknown user](https://agentprime.io/advisories/GHSA-h6fc-48rj-7qqh.md)
  `GHSA-h6fc-48rj-7qqh`, `BIT-tomcat-2026-43512`, `CVE-2026-43512` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `<9.0.118 || >=10.1.0-M1, <10.1.55 || >=11.0.0-M1, <11.0.22`, fixed in `9.0.118`, `10.1.55`, `11.0.22` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Authentication bypass, CWE-592
- [Gaia unauthenticated endpoints](https://agentprime.io/advisories/CVE-2023-30971.md)
  `CVE-2023-30971` · CVE record: Palantir com.palantir.acme.gaia:gaia · CVSS 6.8 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-592
- [An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.](https://agentprime.io/advisories/CVE-2024-42759.md)
  `CVE-2024-42759` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 9 Sept 2024 · Tags: CWE-592
- [An issue in Horizon Business Services Inc.](https://agentprime.io/advisories/CVE-2024-38884.md)
  `CVE-2024-38884` · CVE record · CVSS 7.8 High · Not analysed yet · Published 2 Aug 2024 · Tags: CWE-592
- [Keycloak Authentication Error](https://agentprime.io/advisories/GHSA-jf86-9434-f8c2.md)
  `GHSA-jf86-9434-f8c2`, `CVE-2019-14910` · Maven `org.keycloak:keycloak-parent`: affected `>=7.0.0, <=7.0.1`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-278, CWE-305
- [Keycloak Authentication Error](https://agentprime.io/advisories/GHSA-fv4q-wm8c-wjg4.md)
  `GHSA-fv4q-wm8c-wjg4`, `CVE-2019-14909` · Maven `org.keycloak:keycloak-parent`: affected `>=7.0.0, <=7.0.1`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: Authentication bypass, CWE-305, CWE-592
- [Jenkins Pipeline Classpath Step plugin allowed Script Security sandbox bypass](https://agentprime.io/advisories/GHSA-r5c7-qcc9-5v7m.md)
  `GHSA-r5c7-qcc9-5v7m`, `CVE-2017-2650` · Maven `cprice404:pipeline-classpath`: affected `=0.1.0`, no fixed version yet · CVSS 8.5 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-592
- [Privilege Escalation in Hibernate Validator](https://agentprime.io/advisories/GHSA-xxgp-pcfc-3vgc.md)
  `GHSA-xxgp-pcfc-3vgc`, `CVE-2017-7536` · Maven `org.hibernate:hibernate-validator`: affected `>=5.2.0, <5.2.5.Final || >=5.3.0, <5.3.6.Final || >=5.4.0, <5.4.2.Final`, fixed in `5.2.5.Final`, `5.3.6.Final`, `5.4.2.Final` · CVSS 7.0 High · Not analysed yet · Published 15 Jun 2020 · Tags: Code injection, CWE-592
- [A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester.](https://agentprime.io/advisories/CVE-2019-14843.md)
  `CVE-2019-14843` · CVE record: Red Hat wildfly-security-manager · CVSS 7.5 High · Not analysed yet · Published 7 Jan 2020 · Tags: CWE-592
- [Improper Verification of Cryptographic Signature in keycloak](https://agentprime.io/advisories/GHSA-4fgq-gq9g-3rw7.md)
  `GHSA-4fgq-gq9g-3rw7`, `CVE-2019-10201` · Maven `org.keycloak:keycloak-core`: affected `<7.0.0`, fixed in `7.0.0` · CVSS 8.1 High · Not analysed yet · Published 23 Sept 2019 · Tags: Weak cryptography or TLS, CWE-592
- [An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7.](https://agentprime.io/advisories/CVE-2019-10198.md)
  `CVE-2019-10198` · CVE record: The Foreman Project foreman-tasks · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2019 · Tags: CWE-592
- [heketi: It was found that default configuration of Heketi does not require any authentication…](https://agentprime.io/advisories/CVE-2019-3899.md)
  `CVE-2019-3899` · CVE record: The Heketi Project heketi · CVSS 7.3 High · Not analysed yet · Published 22 Apr 2019 · Tags: CWE-592
- [Baxter SIGMA Spectrum Infusion System: Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery…](https://agentprime.io/advisories/CVE-2014-5432.md)
  `CVE-2014-5432` · CVE record: Baxter SIGMA Spectrum Infusion System · No CVSS score · Not analysed yet · Published 26 Mar 2019 · Tags: CWE-592
- [A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4.](https://agentprime.io/advisories/CVE-2018-10933.md)
  `CVE-2018-10933` · CVE record: \[UNKNOWN\] libssh · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.92 · Not analysed yet · Published 17 Oct 2018 · Tags: CWE-592
- [smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature](https://agentprime.io/advisories/GHSA-gx5g-xcxj-cx2w.md)
  `GHSA-gx5g-xcxj-cx2w`, `CVE-2018-14643` · RubyGems `smart_proxy_dynflow`: affected `<0.1.11 || >=0.2.0, <0.2.1`, fixed in `0.1.11`, `0.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2018 · Tags: Authentication bypass, CWE-592
- [curl: A flaw was found in curl before version 7.51.0 When re-using a connection…](https://agentprime.io/advisories/CVE-2016-8616.md)
  `CVE-2016-8616` · CVE record: The Curl Project curl · CVSS 3.7 Low · Not analysed yet · Published 1 Aug 2018 · Tags: CWE-592
- [prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass.](https://agentprime.io/advisories/CVE-2018-10847.md)
  `CVE-2018-10847` · CVE record: \[UNKNOWN\] prosody · CVSS 4.2 Medium · Not analysed yet · Published 30 Jul 2018 · Tags: CWE-592
- [GNOME gdm: A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once…](https://agentprime.io/advisories/CVE-2017-12164.md)
  `CVE-2017-12164` · CVE record: GNOME gdm · CVSS 4.1 Medium · Not analysed yet · Published 26 Jul 2018 · Tags: CWE-592
- [Dogtag PKI pki-core: It was found that a mock CMC authentication plugin with a hardcoded secret was…](https://agentprime.io/advisories/CVE-2017-7537.md)
  `CVE-2017-7537` · CVE record: Dogtag PKI pki-core · CVSS 5.9 Medium · Not analysed yet · Published 26 Jul 2018 · Tags: CWE-592
- [\[UNKNOWN\] openshift-ansible: openshift-ansible before versions 3.9.23…](https://agentprime.io/advisories/CVE-2018-1085.md)
  `CVE-2018-1085` · CVE record: \[UNKNOWN\] openshift-ansible · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2018 · Tags: CWE-592
- [Phoenix Contact ILC PLCs: The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if…](https://agentprime.io/advisories/CVE-2016-8371.md)
  `CVE-2016-8371` · CVE record: Phoenix Contact Phoenix Contact ILC PLCs · No CVSS score · EPSS 0.11 · Not analysed yet · Published 5 Apr 2018 · Tags: CWE-592
- [Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network access to the affected system, to bypass the application-level au…](https://agentprime.io/advisories/CVE-2017-2684.md)
  `CVE-2017-2684` · CVE record: SIMATIC Logon All versions < V1.5 SP3 Update 2 · No CVSS score · Not analysed yet · Published 22 Feb 2017 · Tags: CWE-592
- [Advantech WebAccess Authentication Bypass Issues](https://agentprime.io/advisories/CVE-2014-2367.md)
  `CVE-2014-2367` · CVE record: Advantech WebAccess · CVSS 7.5 High · Not analysed yet · Published 19 Jul 2014 · Tags: CWE-592
- [I-GEN opLYNX Central Authentication Bypass](https://agentprime.io/advisories/CVE-2012-4688.md)
  `CVE-2012-4688` · CVE record: i-GEN Solutions Corporation opLYNX · CVSS 7.5 High · Not analysed yet · Published 31 Dec 2012 · Tags: CWE-592

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-592>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-592/>. Everything for agents: <https://agentprime.io/llms.txt>.