CWE-697.

Certificate Name Authorization Bypass

• Perforce Puppet Enterprise
• Broken access control
• CWE-697

ZoneMinder failed token handling bypasses web authentication

• zoneminder
• Authentication bypass
• CWE-697

itsmeravitejak Online-Examination-System Session session.php checkLogin comparison

• itsmeravitejak Online-Examination-System
• CWE-697

Incorrect comparison in Google Chrome

• Google Chrome
• CWE-697

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

• Authentication bypass
• CWE-348

>=1.1.0, <2.0.8 · fixed in 2.0.8

CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

• Legion of the Bouncy Castle Inc. BC-JAVA
• Legion of the Bouncy Castle Inc. BC-FJA
• CWE-697

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

• Memory corruption
• CWE-697

<10.7.1 · fixed in 10.7.1

mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet

• Eclipse Foundation Eclipse ThreadX NetX Duo
• Memory corruption
• CWE-697

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

• Server-side request forgery (SSRF)
• CWE-697

<10.5.1 · fixed in 10.5.1

InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)

• InvoicePlane
• CWE-697

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

• Server-side request forgery (SSRF)
• CWE-697

<4.0.0-20260715072853-1c5cad6dec7e · fixed in 4.0.0-20260715072853-1c5cad6dec7e

olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison

• olivier-ls PHP-FTS
• CWE-697

Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state

• OISF suricata
• CWE-697

Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6

• OISF suricata
• CWE-697

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

• CWE-697

>=0.13.0, <0.13.7 · fixed in 0.13.7

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

• Broken access control
• CWE-697

<0.13.7 · fixed in 0.13.7

Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

• Clean Login
• CWE-697

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison Vulnerabilities

• Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
• Cisco Secure Firewall Management Center (FMC)
• CWE-697

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

• @fastify/proxy-addr
• Authentication bypass
• CWE-348

@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

• @fastify/auth
• Broken access control
• CWE-697

evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

• evolution-foundation evolution-api
• CWE-697

MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

• MISP
• Broken access control
• CWE-697

libks has path traversal in kws HTTP parser via URI segment overflow

• signalwire libks
• Path traversal
• CWE-697

ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

• ICEcoder
• Path traversal
• CWE-697

OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

• OpenBSD
• CWE-697

XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

• XenForo
• CWE-697

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

• CWE-697

>=0.1.0, <0.7.1 · fixed in 0.7.1

Wrong interpretation of ACL ranges

• NLnet Labs NSD
• Broken access control
• CWE-697

Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

• cesanta mongoose
• CWE-697

MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

• MemTensor MemOS
• CWE-697

Incorrect comparison in Intel(R) TDX Guest software

• Intel(R) TDX Guest software
• CWE-697

Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

• wolfcms
• CWE-697

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

• Code injection
• Memory corruption

<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0 · fixed in 2.3.6, 3.4.1, 4.9.0

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

• CWE-176
• CWE-697

<83.0.0 · fixed in 83.0.0

FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint

• flaskbb
• CWE-697

666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison

• 666ghj BettaFish
• CWE-187
• CWE-697

HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison

• HdrHistogram
• CWE-697

NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity

• NousResearch hermes-agent
• CWE-178
• CWE-697

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

• Path traversal
• Broken access control

<0.21.0 · fixed in 0.21.0

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

• CWE-697

<1.1.2 · fixed in 1.1.2

ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery

• wolfSSL
• CWE-697

Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)

• roxy-wi
• Path traversal
• CWE-697

Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt

• roxy-wi
• Authentication bypass
• CWE-697

@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers

• CWE-697

<1.4.0 · fixed in 1.4.0

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

• Broken access control
• CWE-697

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

Kavita: Pre-Auth Account Takeover

• Kareadita Kavita
• Authentication bypass
• CWE-345

hermes-agent has an Incorrect Comparison

• CWE-697

<0.15.0 · fixed in 0.15.0

Pingvin Share X: TOTP Authentication Bypass via Password-only Login

• smp46 pingvin-share-x
• Authentication bypass
• CWE-697

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

• CWE-697
• CWE-783

<3.4.0 · fixed in 3.4.0

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

• CWE-440
• CWE-697

<6.2.1 · fixed in 6.2.1

Parse Server has a session field immutability bypass via falsy-value guard

• CWE-697

<8.6.69 || >=9.0.0, <9.7.0-alpha.14 · fixed in 8.6.69, 9.7.0-alpha.14

mppx has Stripe charge credential replay via missing idempotency check

• CWE-697

<0.4.11 · fixed in 0.4.11

rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

• CWE-697

<22.0.11 || >=23.0.0, <23.5.3 || >=25.0.0, <25.3.0 · fixed in 22.0.11, 23.5.3, 25.3.0

Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

• CWE-354
• CWE-697

<0.0.23 · fixed in 0.0.23

Bug fixes in hpke-rs, hpke-rs-rust-crypto

• Memory corruption
• CWE-20

<0.6.0 · fixed in 0.6.0

iccDEV has Type Confusion in CIccTag:IsTypeCompressed()

• InternationalColorConsortium iccDEV
• Memory corruption
• CWE-20

Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability

• Cisco Identity Services Engine Software
• CWE-697

The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure

• stellarwp The Events Calendar
• CWE-697

MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

• CWE-305
• CWE-697

<2.27.2 · fixed in 2.27.2

ConsoleFindCommandMatchList

• CRESTRON TOUCHSCREEN x70
• CRESTRON Touchscreen x60s
• CWE-697