Common Weakness Enumeration
CWE-304
AllowedMissing Critical Step in Authentication
Abstraction: Base · Status: Draft
The product implements an authentication technique, but it skips a step that weakens the technique.
71 vulnerabilities reference this CWE, most recent first.
GHSA-7GWG-2MR3-XHPM
Vulnerability from github – Published: 2025-04-17 18:31 – Updated: 2025-04-23 18:30
VLAI
Details
In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-43014"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T16:16:00Z",
"severity": "MODERATE"
},
"details": "In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation",
"id": "GHSA-7gwg-2mr3-xhpm",
"modified": "2025-04-23T18:30:56Z",
"published": "2025-04-17T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43014"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7QMP-3HH8-G4VW
Vulnerability from github – Published: 2024-08-01 18:32 – Updated: 2024-08-01 18:32
VLAI
Details
In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-6040"
],
"database_specific": {
"cwe_ids": [
"CWE-304",
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-01T16:15:06Z",
"severity": "MODERATE"
},
"details": "In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim\u0027s machine.",
"id": "GHSA-7qmp-3hh8-g4vw",
"modified": "2024-08-01T18:32:50Z",
"published": "2024-08-01T18:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6040"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/ac0bbb1d-89aa-42ba-bc48-1b59bd16acc7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-89PX-WW3J-G2MM
Vulnerability from github – Published: 2019-11-29 17:05 – Updated: 2024-11-19 15:48
VLAI
Summary
2FA bypass in Wagtail through new device path
Details
2FA bypass through new device path
Impact
If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS.
Patches
This problem has been patched in version 1.3.0.
Workarounds
There is no workaround at the moment.
For more information
If you have any questions or comments about this advisory: * Open an issue in github.com/labd/wagtail-2fa * Email us at security@labdigital.nl
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "wagtail-2fa"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-16766"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-304"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:25:10Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## 2FA bypass through new device path\n\n### Impact\nIf someone gains access to someone\u0027s Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS.\n\n### Patches\nThis problem has been patched in version 1.3.0.\n\n### Workarounds\nThere is no workaround at the moment.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)\n* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)",
"id": "GHSA-89px-ww3j-g2mm",
"modified": "2024-11-19T15:48:33Z",
"published": "2019-11-29T17:05:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/labd/wagtail-2fa/security/advisories/GHSA-89px-ww3j-g2mm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16766"
},
{
"type": "WEB",
"url": "https://github.com/labd/wagtail-2fa/commit/13b12995d35b566df08a17257a23863ab6efb0ca"
},
{
"type": "WEB",
"url": "https://github.com/labd/wagtail-2fa/commit/a6711b29711729005770ff481b22675b35ff5c81"
},
{
"type": "PACKAGE",
"url": "https://github.com/labd/wagtail-2fa"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/wagtail-2fa/PYSEC-2019-135.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "2FA bypass in Wagtail through new device path"
}
GHSA-97G8-XFVW-Q4HG
Vulnerability from github – Published: 2022-12-13 19:44 – Updated: 2023-09-20 22:30
VLAI
Summary
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
Details
An issue was discovered in Keycloak when using a client with the offline_access scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.
This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the offline_access scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.
Severity
6.8 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 19.0.2"
},
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-parent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "20.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-3916"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-304",
"CWE-488",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-13T19:44:33Z",
"nvd_published_at": "2023-09-20T15:15:11Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Keycloak when using a client with the `offline_access` scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.\n\nThis issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the `offline_access` scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.",
"id": "GHSA-97g8-xfvw-q4hg",
"modified": "2023-09-20T22:30:19Z",
"published": "2022-12-13T19:44:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-97g8-xfvw-q4hg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8961"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8962"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8963"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8964"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8965"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:1043"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:1044"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:1045"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:1047"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:1049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-3916"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak vulnerable to session takeover with OIDC offline refreshtokens"
}
GHSA-FHFG-FRX8-7458
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32
VLAI
Details
In composiohq/composio version 0.5.10, the API does not validate the x-api-key header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the x-api-key header, thereby gaining unauthorized access to the server.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-8954"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:44Z",
"severity": "CRITICAL"
},
"details": "In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header\u0027s value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the `x-api-key` header, thereby gaining unauthorized access to the server.",
"id": "GHSA-fhfg-frx8-7458",
"modified": "2025-03-20T12:32:49Z",
"published": "2025-03-20T12:32:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8954"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/f1e0fdce-00d7-4261-a466-923062800b12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FHR7-8JX4-R9CP
Vulnerability from github – Published: 2023-12-30 00:30 – Updated: 2024-11-18 16:26
VLAI
Summary
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
Details
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.infinispan:infinispan-server-rest"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0.Dev01"
},
{
"fixed": "15.0.0.Dev04"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.infinispan:infinispan-server-rest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.0.18.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-3628"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-16T17:19:18Z",
"nvd_published_at": "2023-12-18T14:15:08Z",
"severity": "HIGH"
},
"details": "A flaw was found in Infinispan\u0027s REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.",
"id": "GHSA-fhr7-8jx4-r9cp",
"modified": "2024-11-18T16:26:34Z",
"published": "2023-12-30T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3628"
},
{
"type": "WEB",
"url": "https://github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263"
},
{
"type": "WEB",
"url": "https://github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ec"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5396"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3628"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2217924"
},
{
"type": "PACKAGE",
"url": "https://github.com/infinispan/infinispan"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240125-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Infinispan REST Server\u0027s bulk read endpoints do not properly evaluate user permissions"
}
GHSA-G3P7-F346-26M6
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32
VLAI
Details
An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure source like a cookie. This allows an attacker to pass another user's username to the get_model function, thereby gaining unauthorized access to that user's chat history.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-9216"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:47Z",
"severity": "HIGH"
},
"details": "An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users\u0027 chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure source like a cookie. This allows an attacker to pass another user\u0027s username to the get_model function, thereby gaining unauthorized access to that user\u0027s chat history.",
"id": "GHSA-g3p7-f346-26m6",
"modified": "2025-03-20T12:32:50Z",
"published": "2025-03-20T12:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9216"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/21e54c3f-e2d7-423b-9890-1f0cb99af4dd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GX77-XGC2-4888
Vulnerability from github – Published: 2025-11-27 03:30 – Updated: 2025-12-01 20:51
VLAI
Summary
Ray's New Token Authentication is Disabled By Default
Details
Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ray"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.52.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-34351"
],
"database_specific": {
"cwe_ids": [
"CWE-1188",
"CWE-304"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-01T20:51:10Z",
"nvd_published_at": "2025-11-27T03:15:58Z",
"severity": "CRITICAL"
},
"details": "Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default unauthenticated state, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. NOTE: The vendor plans to enable token authentication by default in a future release. They recommend enabling token authentication to protect your cluster from unauthorized access.",
"id": "GHSA-gx77-xgc2-4888",
"modified": "2025-12-01T20:51:10Z",
"published": "2025-11-27T03:30:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-w8vc-465m-jjw6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34351"
},
{
"type": "WEB",
"url": "https://docs.ray.io/en/latest/ray-security/token-auth.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/ray-project/ray"
},
{
"type": "WEB",
"url": "https://github.com/ray-project/ray/releases/tag/ray-2.52.0"
},
{
"type": "WEB",
"url": "https://www.cve.org/resourcessupport/allresources/cnarules#section_4-1_Vulnerability_Determination"
},
{
"type": "WEB",
"url": "https://www.linkedin.com/posts/jonathan-leitschuh_the-latest-piece-of-mind-bending-research-activity-7396976425997606912-qizE"
},
{
"type": "WEB",
"url": "https://www.oligo.security/blog/shadowray-2-0-attackers-turn-ai-against-itself-in-global-campaign-that-hijacks-ai-into-self-propagating-botnet"
},
{
"type": "WEB",
"url": "https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/anyscale-ray-token-authentication-disabled-by-default-insecure-configuration"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Ray\u0027s New Token Authentication is Disabled By Default"
}
GHSA-JVXM-3FC5-8PJR
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32
VLAI
Details
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-76207"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:46Z",
"severity": "HIGH"
},
"details": "phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.",
"id": "GHSA-jvxm-3fc5-8pjr",
"modified": "2026-08-19T15:32:31Z",
"published": "2026-08-19T15:32:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-hvj7-4fmg-53cr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76207"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/phpmyfaq-before-2fa-bypass-via-remember-me-cookie"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M457-GRCF-698X
Vulnerability from github – Published: 2026-09-02 00:31 – Updated: 2026-09-03 15:32
VLAI
Details
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-54391"
],
"database_specific": {
"cwe_ids": [
"CWE-304"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-01T22:17:10Z",
"severity": "CRITICAL"
},
"details": "Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.",
"id": "GHSA-m457-grcf-698x",
"modified": "2026-09-03T15:32:08Z",
"published": "2026-09-02T00:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-54391"
},
{
"type": "WEB",
"url": "https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929"
},
{
"type": "WEB",
"url": "https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022"
},
{
"type": "WEB",
"url": "https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=0f3d14d6be4d9f23e511701696a529ef3b7ffd61"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.