# CWE-799.

Every Advisory and CVE whose sources give the weakness CWE-799, newest first.

## Records, newest first

- [Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication](https://agentprime.io/advisories/CVE-2026-122049.md)
  `CVE-2026-122049` · CVE record: Campcodes Bitcoin Wallet System · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, CWE-799
- [miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication](https://agentprime.io/advisories/CVE-2026-121535.md)
  `CVE-2026-121535` · CVE record: miroslavpejic85 MiroTalk P2P · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Authentication bypass, CWE-799
- [Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks](https://agentprime.io/advisories/CVE-2024-5617.md)
  `CVE-2024-5617` · CVE record: WSO2 WSO2 API Manager and 3 more · CVSS 4.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-799
- [Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg](https://agentprime.io/advisories/CVE-2026-63399.md)
  `CVE-2026-63399` · CVE record: roostorg coop · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-799
- [NocoDB signup validatePassword excessive authentication](https://agentprime.io/advisories/CVE-2026-116123.md)
  `CVE-2026-116123` · CVE record: NocoDB · CVSS 6.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass, CWE-799
- [YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication](https://agentprime.io/advisories/CVE-2026-116007.md)
  `CVE-2026-116007` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass, CWE-799
- [baserCMS: Public Web API mail-form submission bypasses image CAPTCHA](https://agentprime.io/advisories/CVE-2026-115480.md)
  `CVE-2026-115480` · CVE record: baserproject basercms · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-693, CWE-799
- [OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing](https://agentprime.io/advisories/CVE-2026-115359.md)
  `CVE-2026-115359` · CVE record: openbao openbao · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-799
- [Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171](https://agentprime.io/advisories/CVE-2026-96364.md)
  `CVE-2026-96364` · CVE record: Drupal Webform · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-799
- [OpenCATS Career Portal CareersUI.php processLogin excessive authentication](https://agentprime.io/advisories/CVE-2026-111874.md)
  `CVE-2026-111874` · CVE record: OpenCATS · CVSS 6.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass, CWE-799
- [Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint](https://agentprime.io/advisories/CVE-2026-107830.md)
  `CVE-2026-107830` · CVE record: banq jivejdon · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-799
- [PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail](https://agentprime.io/advisories/CVE-2026-82924.md)
  `CVE-2026-82924` · CVE record: Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-799
- [WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97300.md)
  `CVE-2026-97300` · CVE record: Arraytics WP Event Solution · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-799
- [linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication](https://agentprime.io/advisories/CVE-2026-105237.md)
  `CVE-2026-105237` · CVE record: linlinjava litemall · CVSS 6.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, CWE-799
- [ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports](https://agentprime.io/advisories/CVE-2026-100603.md)
  `CVE-2026-100603` · CVE record: openclaw clawhub · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-799
- [Zammad: Missing rate limiting allows password brute-forcing during two-factor login](https://agentprime.io/advisories/CVE-2026-84461.md)
  `CVE-2026-84461` · CVE record: zammad zammad · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Authentication bypass, CWE-799
- [Saleor throttling.py get_client_ip excessive authentication](https://agentprime.io/advisories/CVE-2026-93650.md)
  `CVE-2026-93650` · CVE record: Saleor · CVSS 6.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-799
- [TS4300 Tape Library addresses security vulnerability](https://agentprime.io/advisories/CVE-2025-36045.md)
  `CVE-2025-36045` · CVE record: IBM TS4300 · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-799
- [Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.](https://agentprime.io/advisories/CVE-2025-13882.md)
  `CVE-2025-13882` · CVE record: IBM Sterling Partner Engagement Manager Essentials Edition and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-799
- [OmniBlocks: Spamming in Discussions tab possible via disc.yml](https://agentprime.io/advisories/CVE-2026-54594.md)
  `CVE-2026-54594` · CVE record: OmniBlocks monorepo · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-799
- [phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter](https://agentprime.io/advisories/CVE-2026-85586.md)
  `CVE-2026-85586` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-799
- [Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo](https://agentprime.io/advisories/CVE-2026-54738.md)
  `CVE-2026-54738` · CVE record: LemmyNet lemmy · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-799
- [karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication](https://agentprime.io/advisories/CVE-2026-75773.md)
  `CVE-2026-75773` · CVE record: karakeep-app karakeep · CVSS 6.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Authentication bypass, CWE-799
- [VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication](https://agentprime.io/advisories/CVE-2026-19898.md)
  `CVE-2026-19898` · CVE record: VictoriaMetrics · CVSS 6.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Authentication bypass, CWE-799
- [mangroup dtale Login Endpoint auth.py login excessive authentication](https://agentprime.io/advisories/CVE-2026-19897.md)
  `CVE-2026-19897` · CVE record: mangroup dtale · CVSS 6.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Authentication bypass, CWE-799
- [opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication](https://agentprime.io/advisories/CVE-2026-19895.md)
  `CVE-2026-19895` · CVE record: opensourcepos Open Source Point of Sale · CVSS 6.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Authentication bypass, CWE-799
- [HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a…](https://agentprime.io/advisories/CVE-2024-23565.md)
  `CVE-2024-23565` · CVE record: HCLSoftware Aftermarket EPC · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-799
- [Wazuh: Rate Limit Bypass via /events Endpoint](https://agentprime.io/advisories/CVE-2026-33434.md)
  `CVE-2026-33434` · CVE record: wazuh wazuh · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-799
- [Missing Rate Limiting in Mia Technologies' Pizzy Library](https://agentprime.io/advisories/CVE-2026-5233.md)
  `CVE-2026-5233` · CVE record: MIA Technology Inc. Pizzy Library · CVSS 7.1 High · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-799
- [unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication](https://agentprime.io/advisories/CVE-2026-10216.md)
  `CVE-2026-10216` · CVE record: unitedbyai droidclaw · CVSS 6.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Authentication bypass, CWE-799
- [CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication](https://agentprime.io/advisories/CVE-2026-7671.md)
  `CVE-2026-7671` · CVE record: CodeWise Tornet Scooter Mobile App · CVSS 6.3 Medium · Not analysed yet · Published 2 May 2026 · Tags: Authentication bypass, CWE-799
- [Improper Rate Limiting in MeWare Software's PDKS](https://agentprime.io/advisories/CVE-2026-7402.md)
  `CVE-2026-7402` · CVE record: MeWare Software Development Inc. PDKS · CVSS 8.1 High · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-799
- [Duplicate Advisory: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting](https://agentprime.io/advisories/GHSA-w9f5-8q83-qwpx.md)
  `GHSA-w9f5-8q83-qwpx` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-799
- [Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account](https://agentprime.io/advisories/GHSA-mf69-r24q-ghhr.md)
  `GHSA-mf69-r24q-ghhr` · npm `openclaw`: affected `>=2026.2.26, <2026.3.31`, fixed in `2026.3.31` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-799
- [Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification](https://agentprime.io/advisories/GHSA-2hv5-4h3g-4hjv.md)
  `GHSA-2hv5-4h3g-4hjv` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-799
- [OpenClaw: Pairing pending-request caps were enforced per channel instead of per account](https://agentprime.io/advisories/GHSA-wwfp-w96m-c6x8.md)
  `GHSA-wwfp-w96m-c6x8`, `CVE-2026-41346` · npm `openclaw`: affected `>=2026.2.26, <2026.3.31`, fixed in `2026.3.31` · CVSS 6.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-799
- [OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting](https://agentprime.io/advisories/GHSA-6p8r-6m93-557f.md)
  `GHSA-6p8r-6m93-557f`, `CVE-2026-41333` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Authentication bypass, CWE-799
- [OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification](https://agentprime.io/advisories/GHSA-qcc3-jqwp-5vh2.md)
  `GHSA-qcc3-jqwp-5vh2`, `CVE-2026-41343` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Denial of service, CWE-799
- [HCL Aftermarket DPC is affected by Spamming Vulnerability](https://agentprime.io/advisories/CVE-2025-55268.md)
  `CVE-2025-55268` · CVE record: HCL Aftermarket DPC · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-799
- [Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on \`/api/auth/verify-totp\`](https://agentprime.io/advisories/CVE-2026-32729.md)
  `CVE-2026-32729` · CVE record: runtipi runtipi · CVSS 8.1 High · Not analysed yet · Published 13 Mar 2026 · Tags: Authentication bypass, CWE-799
- [IBM Aspera Console Denial of Service](https://agentprime.io/advisories/CVE-2025-13212.md)
  `CVE-2025-13212` · CVE record: IBM Aspera Console · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-799
- [wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass](https://agentprime.io/advisories/CVE-2026-22216.md)
  `CVE-2026-22216` · CVE record: gVectors wpDiscuz · CVSS 6.9 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-799
- [Parse Server has a rate limit bypass via batch request endpoint](https://agentprime.io/advisories/GHSA-775h-3xrc-c228.md)
  `GHSA-775h-3xrc-c228`, `BIT-parse-2026-30972`, `CVE-2026-30972` · npm `parse-server`: affected `<8.6.23 || >=9.0.0-alpha.1, <9.5.2-alpha.10`, fixed in `8.6.23`, `9.5.2-alpha.10` · CVSS 6.9 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-799
- [Fortinet FortiWeb: An Improper Control of Interaction Frequency vulnerability \[CWE-799\] vulnerability in…](https://agentprime.io/advisories/CVE-2026-24017.md)
  `CVE-2026-24017` · CVE record: Fortinet FortiWeb · CVSS 7.3 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-799
- [OpenClaw's hooks count non-POST requests toward auth lockout](https://agentprime.io/advisories/GHSA-6rmx-gvvg-vh6j.md)
  `GHSA-6rmx-gvvg-vh6j` · npm `openclaw`: affected `<2026.3.7`, fixed in `2026.3.7` · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Authentication bypass, CWE-799
- [Tasin1025 SwiftBuy login.php excessive authentication](https://agentprime.io/advisories/CVE-2026-2110.md)
  `CVE-2026-2110` · CVE record: Tasin1025 SwiftBuy · CVSS 6.3 Medium · Not analysed yet · Published 7 Feb 2026 · Tags: Authentication bypass, CWE-799
- [D-Link DIR-823X Login sub_40AC74 excessive authentication](https://agentprime.io/advisories/CVE-2026-1685.md)
  `CVE-2026-1685` · CVE record: D-Link DIR-823X · CVSS 6.3 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: Authentication bypass, CWE-799
- [Beetel 777VR1 UART excessive authentication](https://agentprime.io/advisories/CVE-2026-1409.md)
  `CVE-2026-1409` · CVE record: Beetel 777VR1 · CVSS 1.0 Low · Not analysed yet · Published 25 Jan 2026 · Tags: Authentication bypass, CWE-799
- [IBM Aspera Orchestrator Denial of Service](https://agentprime.io/advisories/CVE-2025-13211.md)
  `CVE-2025-13211` · CVE record: IBM Aspera Orchestrator · CVSS 5.3 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-799
- [In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the reset password function, leading to an email bombing vulnerability.](https://agentprime.io/advisories/CVE-2025-54321.md)
  `CVE-2025-54321` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-799
- [LogicalDOC Community Edition Admin Login login.jsp excessive authentication](https://agentprime.io/advisories/CVE-2025-12547.md)
  `CVE-2025-12547` · CVE record: LogicalDOC Community Edition · CVSS 6.3 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: Authentication bypass, CWE-799
- [VirtFusion Email Change \_settings excessive authentication](https://agentprime.io/advisories/CVE-2025-12310.md)
  `CVE-2025-12310` · CVE record: VirtFusion · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Authentication bypass, CWE-799
- [JhumanJ OpnForm HTTP Header excessive authentication](https://agentprime.io/advisories/CVE-2025-11441.md)
  `CVE-2025-11441` · CVE record: JhumanJ OpnForm · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Authentication bypass, CWE-799
- [Harness Login Endpoint login excessive authentication](https://agentprime.io/advisories/CVE-2025-10761.md)
  `CVE-2025-10761` · CVE record: Harness · CVSS 6.3 Medium · Not analysed yet · Published 21 Sept 2025 · Tags: Authentication bypass, CWE-799
- [Fides Webserver API Rate Limiting Vulnerability in Proxied Environments](https://agentprime.io/advisories/GHSA-fq34-xw6c-fphf.md)
  `GHSA-fq34-xw6c-fphf`, `CVE-2025-57816`, `PYSEC-2026-1341` · PyPI `ethyca-fides`: affected `<2.69.1`, fixed in `2.69.1` · CVSS 6.3 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: Authentication bypass, Denial of service, CWE-799
- [mtons mblog password excessive authentication](https://agentprime.io/advisories/CVE-2025-9004.md)
  `CVE-2025-9004` · CVE record: mtons mblog · CVSS 6.3 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: Authentication bypass, CWE-799
- [mtons mblog Verification Code send_code excessive authentication](https://agentprime.io/advisories/CVE-2025-8927.md)
  `CVE-2025-8927` · CVE record: mtons mblog · CVSS 6.3 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Authentication bypass, CWE-799
- [macrozheng mall Admin Login excessive authentication](https://agentprime.io/advisories/CVE-2025-8742.md)
  `CVE-2025-8742` · CVE record: macrozheng mall · CVSS 6.3 Medium · Not analysed yet · Published 8 Aug 2025 · Tags: Authentication bypass, CWE-799
- [Mercusys MW301R Login excessive authentication](https://agentprime.io/advisories/CVE-2025-7882.md)
  `CVE-2025-7882` · CVE record: Mercusys MW301R · CVSS 2.3 Low · Not analysed yet · Published 20 Jul 2025 · Tags: Authentication bypass, CWE-799
- [Traceroute_APP responses are not rate-limited.](https://agentprime.io/advisories/CVE-2024-47065.md)
  `CVE-2024-47065` · CVE record: meshtastic firmware · CVSS 2.7 Low · Not analysed yet · Published 11 Jul 2025 · Tags: CWE-799

Older: <https://agentprime.io/advisories/tag/cwe-799.md?cursor=WyIyMDI1LTA3LTExVDE3OjAwOjQ0LjIyMTAwMFoiLCJDVkUtMjAyNC00NzA2NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-799>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-799/>. Everything for agents: <https://agentprime.io/llms.txt>.