CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
310 vulnerabilities reference this CWE, most recent first.
GHSA-J6QM-XGXC-G34G
Vulnerability from github – Published: 2024-02-05 06:30 – Updated: 2024-02-09 03:33In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419.
{
"affected": [],
"aliases": [
"CVE-2024-20015"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-05T06:15:47Z",
"severity": "HIGH"
},
"details": "In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419.",
"id": "GHSA-j6qm-xgxc-g34g",
"modified": "2024-02-09T03:33:00Z",
"published": "2024-02-05T06:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20015"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J83X-R9QQ-9G4V
Vulnerability from github – Published: 2023-03-10 03:30 – Updated: 2023-03-15 19:17Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-1307"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-10T22:16:14Z",
"nvd_published_at": "2023-03-10T01:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.",
"id": "GHSA-j83x-r9qq-9g4v",
"modified": "2023-03-15T19:17:36Z",
"published": "2023-03-10T03:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1307"
},
{
"type": "WEB",
"url": "https://github.com/froxlor/froxlor/commit/6777fbf229200f4fd566022e186548391219ab23"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/5fe85af4-a667-41a9-a00d-f99e07c5e2f1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Froxlor is vulnerable to authentication bypass"
}
GHSA-JH6M-3PQW-242H
Vulnerability from github – Published: 2022-02-09 00:56 – Updated: 2022-08-12 20:52A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/keycloak/keycloak-gatekeeper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14359"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-01T16:13:00Z",
"nvd_published_at": "2021-02-23T13:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.",
"id": "GHSA-jh6m-3pqw-242h",
"modified": "2022-08-12T20:52:13Z",
"published": "2022-02-09T00:56:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14359"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/12934"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868591"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak-gatekeeper"
},
{
"type": "WEB",
"url": "https://issues.jboss.org/browse/KEYCLOAK-14090"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20190613000352/github.com/keycloak/keycloak-gatekeeper"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers"
}
GHSA-JP3F-X449-4Q75
Vulnerability from github – Published: 2026-05-18 09:31 – Updated: 2026-06-01 15:04Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "11.5.0"
},
{
"fixed": "11.5.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.11.0"
},
{
"fixed": "10.11.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0-20260318173148-e9ae890a013b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.2-0.20260318173148-e9ae890a013b"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6334"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-01T15:04:48Z",
"nvd_published_at": "2026-05-18T08:16:14Z",
"severity": "LOW"
},
"details": "Mattermost versions 11.5.x \u003c= 11.5.1, 10.11.x \u003c= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570",
"id": "GHSA-jp3f-x449-4q75",
"modified": "2026-06-01T15:04:49Z",
"published": "2026-05-18T09:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6334"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/e9ae890a013bb57989fcbdb548d8b7b86b240237"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost doesn\u0027t enforce client identity binding during the OAuth authorization code redemption flow"
}
GHSA-JVR3-FJ9R-5Q66
Vulnerability from github – Published: 2023-09-06 18:30 – Updated: 2025-11-04 21:30Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only
{
"affected": [],
"aliases": [
"CVE-2023-4498"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-06T17:15:50Z",
"severity": "MODERATE"
},
"details": "Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only",
"id": "GHSA-jvr3-fj9r-5q66",
"modified": "2025-11-04T21:30:39Z",
"published": "2023-09-06T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4498"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/304455"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/304455"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JWXC-5CH3-VXQQ
Vulnerability from github – Published: 2024-12-24 06:30 – Updated: 2026-05-06 18:30A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the "admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.
{
"affected": [],
"aliases": [
"CVE-2024-12582"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-24T04:15:05Z",
"severity": "HIGH"
},
"details": "A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.",
"id": "GHSA-jwxc-5ch3-vxqq",
"modified": "2026-05-06T18:30:23Z",
"published": "2024-12-24T06:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12582"
},
{
"type": "WEB",
"url": "https://github.com/skupperproject/skupper/pull/1833"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:1413"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-12582"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333540"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JX2P-C252-QCMR
Vulnerability from github – Published: 2024-07-11 09:30 – Updated: 2024-07-11 09:30Nuvoton - CWE-305: Authentication Bypass by Primary Weakness
An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock
reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code
execution.
{
"affected": [],
"aliases": [
"CVE-2024-38433"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-11T08:15:10Z",
"severity": "MODERATE"
},
"details": "Nuvoton - CWE-305: Authentication Bypass by Primary Weakness\n\nAn attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock\n\nreference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code\n\nexecution.",
"id": "GHSA-jx2p-c252-qcmr",
"modified": "2024-07-11T09:30:58Z",
"published": "2024-07-11T09:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38433"
},
{
"type": "WEB",
"url": "https://www.gov.il/en/Departments/faq/cve_advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M24W-WG7M-X27H
Vulnerability from github – Published: 2024-02-27 18:31 – Updated: 2025-02-11 18:31In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication.
{
"affected": [],
"aliases": [
"CVE-2024-1403"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-27T16:15:45Z",
"severity": "CRITICAL"
},
"details": "In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.\u00a0 The\nvulnerability is a bypass to authentication based on a failure to properly\nhandle username and password. Certain unexpected\ncontent passed into the credentials can lead to unauthorized access without proper\nauthentication. \u00a0",
"id": "GHSA-m24w-wg7m-x27h",
"modified": "2025-02-11T18:31:11Z",
"published": "2024-02-27T18:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1403"
},
{
"type": "WEB",
"url": "https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer"
},
{
"type": "WEB",
"url": "https://www.progress.com/openedge"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M7XM-HF59-W6RJ
Vulnerability from github – Published: 2026-07-03 09:31 – Updated: 2026-07-06 18:30libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.
{
"affected": [],
"aliases": [
"CVE-2026-8932"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-03T07:16:25Z",
"severity": "HIGH"
},
"details": "libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.",
"id": "GHSA-m7xm-hf59-w6rj",
"modified": "2026-07-06T18:30:48Z",
"published": "2026-07-03T09:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3733910"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-8932.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2026-8932.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M82C-83JF-3J4V
Vulnerability from github – Published: 2026-08-26 00:30 – Updated: 2026-08-26 21:31Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.
The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row's user_id with the challenged user's id through Perl's integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.
The challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim's password and holds a recovery code of their own passes the victim's second factor.
{
"affected": [],
"aliases": [
"CVE-2026-78619"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T22:17:06Z",
"severity": "CRITICAL"
},
"details": "Punk::Plugin::TOTP versions before 0.05 for Perl accept another account\u0027s recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.\n\nThe helper searches the recovery model for the submitted code\u0027s digest alone, across every user\u0027s rows, so the ownership test that follows is the only thing binding a code to the account it was issued to. That test compares the row\u0027s user_id with the challenged user\u0027s id through Perl\u0027s integer coercion, and an identifier with no leading digits coerces to zero, so any two of them compare equal. User models keyed on a username, an email address or a UUID hit that case, and a numeric key compares as intended.\n\nThe challenge route feeds a submitted value to the helper once TOTP verification fails, so an attacker who knows a victim\u0027s password and holds a recovery code of their own passes the victim\u0027s second factor.",
"id": "GHSA-m82c-83jf-3j4v",
"modified": "2026-08-26T21:31:39Z",
"published": "2026-08-26T00:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78619"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/source/include/ptotp/ptotp_plugin.h#L801-827"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.04/view/lib/Punk/Plugin/TOTP.pm"
},
{
"type": "WEB",
"url": "https://metacpan.org/release/LNATION/Punk-TOTP-0.05/source/Changes"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/25/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.