CWE-302 · Authentication Bypass by Assumed-Immutable Data
40 CVEs classified under CWE-302 (Authentication Bypass by Assumed-Immutable Data). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-29813 | Critical | 10.0 | 2025-05-08 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-48781 | Critical | 9.9 | 2026-06-17 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a sessio… |
CVE-2024-56404 | Critical | 9.9 | 2025-01-24 | In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installa… |
CVE-2025-63210 | Critical | 9.8 | 2025-11-19 | The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t… |
CVE-2024-43441 | Critical | 9.8 | 2024-12-24 | Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0… |
CVE-2023-4612 | Critical | 9.8 | 2023-11-09 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T… |
CVE-2023-4669 | Critical | 9.8 | 2023-09-14 | Authentication Bypass by Assumed-Immutable Data vulnerability in Exagate SYSGuard 3001 allows Authentication Bypass. This issue affects SYSGuard 3001: before… |
CVE-2016-9482 | Critical | 9.8 | 2018-07-13 | Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigatin… |
CVE-2025-47158 | Critical | 9.0 | 2025-07-18 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-47303 | High | 8.8 | 2026-07-14 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-40285 | High | 8.8 | 2026-04-17 | WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usu… |
CVE-2024-12838 | High | 8.8 | 2024-12-31 | The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regu… |
CVE-2022-22729 | High | 8.8 | 2022-03-11 | CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via… |
CVE-2026-50528 | High | 8.2 | 2026-07-14 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-39429 | High | 8.2 | 2026-04-08 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server i… |
CVE-2025-8855 | High | 8.1 | 2025-11-14 | Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vuln… |
CVE-2025-24876 | High | 8.1 | 2025-02-11 | The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal t… |
CVE-2024-3741 | High | 7.5 | 2024-04-18 | Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except '… |
CVE-2024-22179 | High | 7.5 | 2024-04-18 | The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the a… |
CVE-2020-15074 | High | 7.5 | 2020-07-14 | OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making… |