CWE-636.

vault-java-driver: SslConfig silently disables requested TLS verification

• jopenlibs vault-java-driver
• Weak cryptography or TLS
• CWE-636

Sandboxie-Plus: Sandbox containment bypass

• Sandboxie
• Information disclosure
• Broken access control

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

• node-opcua
• Broken access control
• CWE-636

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.

• SonicWall Global Management System (GMS)
• CWE-636

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

• Apache Software Foundation Apache Kafka
• Weak cryptography or TLS
• CWE-345

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

• Veeam Backup and Replication
• CWE-636

Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization

• Apache Software Foundation Apache Pulsar
• CWE-636

Not Failing Securely ('Failing Open') in hMailServer

• Progressive Robot Ltd hMailServer
• CWE-636

Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

• Apache Software Foundation Apache Tomcat
• CWE-636

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

• Weak cryptography or TLS
• CWE-636

>=0.1.0, <0.20.0 · fixed in 0.20.0

Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

• Dell Secure Connect Gateway (SCG) Policy Manager
• CWE-636

SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)

• sumatrapdf
• CWE-636

Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials

• Docker Sandboxes
• CWE-636

Not Failing Securely ('Failing Open') in hMailServer

• Progressive Robot Ltd hMailServer
• CWE-636

pgjdbc does not enforce requireAuth when the value excludes every authentication method

• pgjdbc
• CWE-636

Authentication bypass via blank auth token in P4Search

• Perforce P4 (Helix Core)
• CWE-636

heym before 0.0.105 Authentication Bypass via Redis Node

• heym
• CWE-636

TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check

• TDuckCloud tduck-survey-form
• CWE-636

@bytebase/dbhub's read-only mode does not prevent database writes

• Broken access control
• CWE-184

<0.22.6 · fixed in 0.22.6

Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

• Red Hat Hardened Images
• CWE-636

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

• Denial of service
• Broken access control

<0.18.1 · fixed in 0.18.1

AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

• WatchGuard AuthPoint Authentication Gateway
• Authentication bypass
• CWE-636

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

• Broken access control
• CWE-178

<1.0.1-0.20260720133915-80bc87188ec3 · fixed in 1.0.1-0.20260720133915-80bc87188ec3

Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

• cms
• CWE-636

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

• Broken access control
• CWE-636

<1.0.7 · fixed in 1.0.7

Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

• maziggy bambuddy
• CWE-636
• CWE-755

SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

• Server-side request forgery (SSRF)
• CWE-636

>=0.1.0 · no fixed version yet

Visual Studio Code Security Feature Bypass Vulnerability

• Microsoft Visual Studio Code
• CWE-636

APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard

• apitable
• CWE-636

Unchecked return value in chewkeanho software-actualizer

• chewkeanho software-actualizer
• CWE-252
• CWE-636

NGINX ngx_http_js_module vulnerability

• F5 NGINX JavaScript
• CWE-636

Ash.Reactor change step fails open, skipping a change when its where guard raises

• CWE-636

>=3.0.0-rc.17, <3.32.2 · fixed in 3.32.2

IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File

• IGEL OS 12
• IGEL OS 11
• CWE-636

AIIR verification and policy gates could report success without enforcing the control (fail-open)

• Weak cryptography or TLS
• CWE-636

<1.7.0 · fixed in 1.7.0

MyBB: Security Question insufficient validation

• mybb
• CWE-636

rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

• rsync
• Broken access control
• CWE-636

Visual Studio Code Security Feature Bypass Vulnerability

• Microsoft Visual Studio Code
• CWE-636

Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

• CWE-636

>=0.19.7, <0.19.9 · fixed in 0.19.9

Fallback to second RAUC slot with default credentials

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• CWE-636

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

• CWE-636

<0.61.3 · fixed in 0.61.3

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

• Broken access control
• CWE-636

>=5.0.0-beta.0, <5.0.0-beta.32 · fixed in 5.0.0-beta.32

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

• Broken access control
• CWE-636

<4.5.10 || >=4.6.0, <4.6.2 · fixed in 4.5.10, 4.6.2

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

• CWE-636
• CWE-757

>=42.7.4, <42.7.12 · fixed in 42.7.12

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

• Broken access control
• CWE-302

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

Grav Flex-Objects < 1.4.3 Authorization Bypass via API

• grav
• Broken access control
• CWE-636

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

• Authentication bypass
• CWE-636

>=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

OpenClaw: Mattermost handlers could fall open when channel type was missing

• CWE-636

<2026.5.6 · fixed in 2026.5.6

OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms

• CWE-636
• CWE-757

<3.3 · fixed in 3.3

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

• CWE-636
• CWE-693

>=3.7.0-ea.1, <3.7.5 · fixed in 3.7.5

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

• Weak cryptography or TLS
• CWE-636

<7.12.1 · fixed in 7.12.1

OpenClaw: Empty-scope device re-pairing could confuse caller scope containment

• CWE-636

<2026.4.25 · fixed in 2026.4.25

Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment

• CWE-636

<=2026.4.24 · no fixed version yet

Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing

• CWE-636

<2026.5.6 · fixed in 2026.5.6

Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot

• Indian Motorcycle Scout Bobber + Tech
• CWE-636
• CWE-696

Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot

• Indian Motorcycle Scout Bobber + Tech
• CWE-636
• CWE-696

MCP Registry: OCI validator skips ownership check on upstream rate limits

• CWE-636

<1.7.9 · fixed in 1.7.9

net-imap vulnerable to STARTTLS stripping via invalid response timing

• CWE-325
• CWE-392

<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.3.10, 0.4.24, 0.5.14, 0.6.4

OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes

• CWE-636

<0.3.9 · fixed in 0.3.9

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors

• CWE-636
• CWE-754

<=1.4.2 · no fixed version yet

free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

• Broken access control
• CWE-636

<=1.4.2 · no fixed version yet