CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
302 vulnerabilities reference this CWE, most recent first.
GHSA-6J5C-GC78-PQGR
Vulnerability from github – Published: 2025-10-20 15:30 – Updated: 2025-10-20 18:30A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.
{
"affected": [],
"aliases": [
"CVE-2025-56224"
],
"database_specific": {
"cwe_ids": [
"CWE-305",
"CWE-307"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-20T13:15:44Z",
"severity": "MODERATE"
},
"details": "A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack.",
"id": "GHSA-6j5c-gc78-pqgr",
"modified": "2025-10-20T18:30:32Z",
"published": "2025-10-20T15:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56224"
},
{
"type": "WEB",
"url": "https://github.com/saykino/CVE-2025-56224"
},
{
"type": "WEB",
"url": "http://ascertia.com"
},
{
"type": "WEB",
"url": "http://signinghub.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6P47-2PGH-WJ76
Vulnerability from github – Published: 2025-05-08 12:34 – Updated: 2025-05-14 12:31Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
{
"affected": [],
"aliases": [
"CVE-2025-41450"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-08T10:15:18Z",
"severity": "HIGH"
},
"details": "Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2",
"id": "GHSA-6p47-2pgh-wj76",
"modified": "2025-05-14T12:31:11Z",
"published": "2025-05-08T12:34:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41450"
},
{
"type": "WEB",
"url": "https://sm800a.danfoss.com/sw_shared/SM800A-4.2.4.spk"
},
{
"type": "WEB",
"url": "https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6W6J-7XVM-32V2
Vulnerability from github – Published: 2026-01-23 15:31 – Updated: 2026-06-05 18:31Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation.This issue affects Sufirmam: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-4320"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-23T13:15:49Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation.This issue affects Sufirmam: through 23012026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-6w6j-7xvm-32v2",
"modified": "2026-06-05T18:31:31Z",
"published": "2026-01-23T15:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4320"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0005"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-26-0005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-73VG-MQ6J-X5W2
Vulnerability from github – Published: 2026-01-22 21:33 – Updated: 2026-01-22 21:33A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible client to view system logs and perform operations without valid credentials. No evidence of exploitation was identified during the vulnerability window.
{
"affected": [],
"aliases": [
"CVE-2025-68609"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-22T19:15:53Z",
"severity": "MODERATE"
},
"details": "A vulnerability in Palantir\u0027s Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible client to view system logs and perform operations without valid credentials. No evidence of exploitation was identified during the vulnerability window.",
"id": "GHSA-73vg-mq6j-x5w2",
"modified": "2026-01-22T21:33:47Z",
"published": "2026-01-22T21:33:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68609"
},
{
"type": "WEB",
"url": "https://palantir.safebase.us/?tcuUid=955a313a-1735-48a6-9fb4-e10404f14eb5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-75CM-X2W3-8MGF
Vulnerability from github – Published: 2026-05-15 03:30 – Updated: 2026-05-21 19:35A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (--app-name basic-auth) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on /gateway/ routes, leaving other routes such as the Job API (/ajax-api/3.0/jobs/*) and the OpenTelemetry trace ingestion API (/v1/traces) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the _find_fastapi_validator() function fails to handle non-/gateway/ paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mlflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-2652"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-21T19:35:52Z",
"nvd_published_at": "2026-05-15T03:16:23Z",
"severity": "HIGH"
},
"details": "A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.",
"id": "GHSA-75cm-x2w3-8mgf",
"modified": "2026-05-21T19:35:52Z",
"published": "2026-05-15T03:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2652"
},
{
"type": "WEB",
"url": "https://github.com/mlflow/mlflow/commit/bb62e773263c14e9ba4d1a82fe72d0de2442c6aa"
},
{
"type": "PACKAGE",
"url": "https://github.com/mlflow/mlflow"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/5aeff5f0-49c7-4180-b5cb-c9a046f16756"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "MLflow: unauthenticated access to certain FastAPI routes"
}
GHSA-777H-HPFJ-X7HV
Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2025-11-04 00:32The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent.
{
"affected": [],
"aliases": [
"CVE-2025-31192"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T23:15:29Z",
"severity": "MODERATE"
},
"details": "The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. A website may be able to access sensor information without user consent.",
"id": "GHSA-777h-hpfj-x7hv",
"modified": "2025-11-04T00:32:26Z",
"published": "2025-04-01T00:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31192"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122371"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122373"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122379"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/2"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/4"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7JC6-P5M2-4PFV
Vulnerability from github – Published: 2024-09-05 12:31 – Updated: 2024-09-05 12:31This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.
{
"affected": [],
"aliases": [
"CVE-2024-5957"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-05T11:15:12Z",
"severity": "MODERATE"
},
"details": "This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.",
"id": "GHSA-7jc6-p5m2-4pfv",
"modified": "2024-09-05T12:31:16Z",
"published": "2024-09-05T12:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5957"
},
{
"type": "WEB",
"url": "https://thrive.trellix.com/s/article/000013870"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-7PQ9-RF9P-WCRF
Vulnerability from github – Published: 2025-09-29 20:40 – Updated: 2025-10-23 20:32Description
A vulnerability exists in go-f3's justification verification caching mechanism where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by: 1. First submitting a valid message with a correct justification 2. Then reusing the same cached justification in contexts where it would normally be invalid
This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with.
Impact
- Potential consensus integrity issues through invalid justification acceptance
- Could affect network liveness if exploited systematically
- May allow malicious actors to influence consensus decisions with invalid justifications
- Requires significant power (350+ TiB due to power table rounding) to meaningfully exploit
- It would also be difficult to exploit in a synchronised fashion, such that >1/3 of the network goes down at one time. This isn't a one-msg panic, where you can spam it and bring everyone down, because every node will have a different amount of memory andmany SPs also run redundant lotus nodes.
Patches
The fix was merged and released with go-f3 0.8.9. All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.
Workarounds
The are no immediate workarounds available. Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.
Credits
The bug was reported by @lgprbs via our bug bounty program. Thank you for the contributions.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/filecoin-project/go-f3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59941"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-29T20:40:02Z",
"nvd_published_at": "2025-09-29T23:15:32Z",
"severity": "MODERATE"
},
"details": "### Description\nA vulnerability exists in go-f3\u0027s justification verification caching mechanism where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by:\n1. First submitting a valid message with a correct justification\n2. Then reusing the same cached justification in contexts where it would normally be invalid\n\nThis occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it\u0027s being used with.\n\n### Impact\n- Potential consensus integrity issues through invalid justification acceptance\n- Could affect network liveness if exploited systematically\n- May allow malicious actors to influence consensus decisions with invalid justifications\n- Requires significant power (350+ TiB due to power table rounding) to meaningfully exploit\n- It would also be difficult to exploit in a synchronised fashion, such that \u003e1/3 of the network goes down at one time. This isn\u0027t a one-msg panic, where you can spam it and bring everyone down, because every node will have a different amount of memory andmany SPs also run redundant lotus nodes. \n\n### Patches\nThe fix was merged and released with go-f3 0.8.9. All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.\n\n### Workarounds\nThe are no immediate workarounds available. Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.\n\n### Credits\nThe bug was reported by @lgprbs via our bug bounty program. Thank you for the contributions.",
"id": "GHSA-7pq9-rf9p-wcrf",
"modified": "2025-10-23T20:32:35Z",
"published": "2025-09-29T20:40:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59941"
},
{
"type": "WEB",
"url": "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625"
},
{
"type": "PACKAGE",
"url": "https://github.com/filecoin-project/go-f3"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3989"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "go-f3 Vulnerable to Cached Justification Verification Bypass"
}
GHSA-7Q8X-6CWC-CX3J
Vulnerability from github – Published: 2023-08-03 00:30 – Updated: 2024-04-04 06:30ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.
{
"affected": [],
"aliases": [
"CVE-2023-1935"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-02T23:15:10Z",
"severity": "CRITICAL"
},
"details": "ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition.",
"id": "GHSA-7q8x-6cwc-cx3j",
"modified": "2024-04-04T06:30:06Z",
"published": "2023-08-03T00:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1935"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7WWR-H8CM-9JF7
Vulnerability from github – Published: 2025-02-10 21:31 – Updated: 2025-03-03 20:08Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-4rcc-7pg7-f57f. This link is maintained to preserve external references.
Original Description
Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "OPCFoundation.NetStandard.Opc.Ua"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.374.158"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-10T22:57:35Z",
"nvd_published_at": "2025-02-10T19:15:38Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-4rcc-7pg7-f57f. This link is maintained to preserve external references.\n\n## Original Description\nVulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints.",
"id": "GHSA-7wwr-h8cm-9jf7",
"modified": "2025-03-03T20:08:30Z",
"published": "2025-02-10T21:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42513"
},
{
"type": "WEB",
"url": "https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2024-42513.pdf"
},
{
"type": "PACKAGE",
"url": "https://github.com/OPCFoundation/UA-.NETStandard"
},
{
"type": "WEB",
"url": "https://github.com/OPCFoundation/UA-.NETStandard/tree/1.5.374.158"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack",
"withdrawn": "2025-03-03T20:08:30Z"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.