CWE-303 · Incorrect Implementation of Authentication Algorithm
92 CVEs classified under CWE-303 (Incorrect Implementation of Authentication Algorithm). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46389 | Critical | 10.0 | 2026-06-05 | UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0… |
CVE-2026-46595 | Critical | 10.0 | 2026-05-22 | Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key… |
CVE-2025-13390 | Critical | 10.0 | 2025-12-03 | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of… |
CVE-2022-20695 | Critical | 10.0 | 2022-04-15 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass a… |
CVE-2025-12421 | Critical | 9.9 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange… |
CVE-2025-12419 | Critical | 9.9 | 2025-11-27 | Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Conn… |
CVE-2022-39366 | Critical | 9.9 | 2022-10-28 | DataHub is an open-source metadata platform. Prior to version 0.8.45, the `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the sig… |
CVE-2026-35579 | Critical | 9.8 | 2026-05-05 | CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authenticat… |
CVE-2026-29515 | Critical | 9.8 | 2026-03-11 | MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without… |
CVE-2025-66489 | Critical | 9.8 | 2025-12-03 | Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a… |
CVE-2025-63210 | Critical | 9.8 | 2025-11-19 | The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit t… |
CVE-2025-21311 | Critical | 9.8 | 2025-01-14 | Windows NTLM V1 Elevation of Privilege Vulnerability |
CVE-2024-10127 | Critical | 9.8 | 2024-11-20 | Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user aut… |
CVE-2024-7593 | Critical | 9.8 | 2024-08-13 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass a… |
CVE-2024-4985 | Critical | 9.8 | 2024-05-20 | An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional e… |
CVE-2023-3326 | Critical | 9.8 | 2023-06-22 | pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Ce… |
CVE-2023-29357 | Critical | 9.8 | 2023-06-14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
CVE-2018-4841 | Critical | 9.8 | 2018-03-29 | A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform a… |
CVE-2023-4860 | Critical | 9.6 | 2024-07-16 | Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-28446 | Critical | 9.4 | 2026-03-05 | OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist pol… |