CWE-1390: Weak Authentication

Class

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attackers may be able to bypass weak authentication faster and/or with less effort than expected.

Consequences

Integrity, Confidentiality, Availability, Access Control: Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands

Recent advisories

CVE-2026-55040 — Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
GHSA-qxvm-r42f-5p8j — AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
GHSA-2865-hh9g-w894 — Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability

All advisories for CWE-1390

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor