CWE-302 · Authentication Bypass by Assumed-Immutable Data

43 CVEs classified under CWE-302 (Authentication Bypass by Assumed-Immutable Data). Browse by severity and year.

Top CVEs for CWE-302
CVESeverityScorePublishedSummary
CVE-2025-29813Critical10.02025-05-08Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-48781Critical9.92026-06-17Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a sessio…
CVE-2024-56404Critical9.92025-01-24In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installa…
CVE-2025-63210Critical9.82025-11-19The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t…
CVE-2024-43441Critical9.82024-12-24Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0…
CVE-2023-4612Critical9.82023-11-09Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T…
CVE-2023-4669Critical9.82023-09-14Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before…
CVE-2016-9482Critical9.82018-07-13Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigatin…
CVE-2025-47158Critical9.02025-07-18Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-47303High8.82026-07-14Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-40285High8.82026-04-17WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usu…
CVE-2024-12838High8.82024-12-31The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regu…
CVE-2022-22729High8.82022-03-11CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via…
CVE-2026-50528High8.22026-07-14Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-39429High8.22026-04-08kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server i…
CVE-2026-13267High8.12026-08-12IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0…
CVE-2025-8855High8.12025-11-14Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vuln…
CVE-2025-24876High8.12025-02-11The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal t…
CVE-2024-3741High7.52024-04-18Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except '…
CVE-2024-22179High7.52024-04-18The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the a…
All CVEs classified under CWE-302 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-77508Low3.52026-08-26Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/u…
CVE-2026-13267High8.12026-08-12IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0…
CVE-2026-54232026-08-06@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription…
CVE-2026-50528High8.22026-07-14Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47303High8.82026-07-14Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-48117Medium6.82026-06-17DroneAware is a drone detection platform. The centralized DroneAware server backing droneaware.io was vulnerable to an account pre-hijacking attack in which an…
CVE-2026-48781Critical9.92026-06-17Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a sessio…
CVE-2026-34460Medium5.42026-06-02NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-sid…
CVE-2025-43992Medium5.62026-05-11Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an authentication bypass by assumed-immutable data vulnerabi…
CVE-2026-28510Medium5.92026-05-05eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication…
CVE-2026-40285High8.82026-04-17WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usu…
CVE-2026-39429High8.22026-04-08kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server i…
CVE-2026-27840Medium4.32026-02-26ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC access tokens in the v2…
CVE-2024-45370High7.32025-12-01An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A specially crafted database…
CVE-2025-63210Critical9.82025-11-19The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t…
CVE-2025-8855High8.12025-11-14Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vuln…
CVE-2025-47158Critical9.02025-07-18Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-20285Medium4.12025-07-16A vulnerability in the IP Access Restriction feature of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to bypass configured IP acces…
CVE-2025-46647Medium5.32025-07-02A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions are met: 1. Use the…
CVE-2025-29813Critical10.02025-05-08Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-265222025-02-14This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker w…
CVE-2025-24876High8.12025-02-11The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal t…
CVE-2024-56404Critical9.92025-01-24In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installa…
CVE-2024-12838High8.82024-12-31The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regu…
CVE-2024-43441Critical9.82024-12-24Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0…
CVE-2024-8475Medium6.52024-12-17Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This iss…
CVE-2024-49056High7.32024-11-12Authentication bypass by assumed-immutable data on airlift.microsoft.com allows an authorized attacker to elevate privileges over a network.
CVE-2024-47086Medium6.52024-09-19This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authentica…
CVE-2024-3462Medium5.42024-05-14Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-ad…
CVE-2024-4024High7.32024-04-25An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versi…
CVE-2024-3741High7.52024-04-18Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except '…
CVE-2024-22179High7.52024-04-18The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the a…
CVE-2023-47127Medium4.22023-11-14TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different site…
CVE-2023-4612Critical9.82023-11-09Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T…
CVE-2023-4669Critical9.82023-09-14Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before…
CVE-2022-3875High7.32022-12-19A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown…
CVE-2022-40703Medium5.22022-10-26CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on Android allows an unauthenticated attack…
CVE-2022-2503Medium6.92022-08-12Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root f…
CVE-2022-22729High8.82022-03-11CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via…
CVE-2021-1561Medium5.42021-08-18A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authen…
CVE-2021-1399Medium4.32021-04-08A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Editio…
CVE-2020-15074High7.52020-07-14OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making…
CVE-2016-9482Critical9.82018-07-13Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigatin…