Skip to content
Log inStart free trial

CWE-287: Improper Authentication

ClassLikelihood of exploit: High

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Consequences

  • Integrity, Confidentiality, Availability, Access Control: Read Application Data, Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands

How to prevent it

  • Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Recent advisories

  • GHSA-f9x3-7vq9-cph6 — Laravel TokenGuard authentication bypass through non-string API credentials
  • GHSA-r4xp-prcw-77qf — better-auth: OAuth Proxy lets an attacker sign in as another user
  • GHSA-965c-763c-88jm — better-auth: OAuth state can be used as a Magic Link to sign in as another user
  • GO-2026-6773 — Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
  • GO-2026-6786 — Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
  • GHSA-xv7q-fvmc-jx96 — Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
  • GHSA-68w4-83fh-f2w8 — pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
  • GHSA-r44w-v6gf-x3p6 — pyLoad has an authentication bypass in API key validation (check_apikey cache)
  • GHSA-45gv-9wjv-xh7p — Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
  • GHSA-2jwh-9rmr-j4xf — AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)
  • CVE-2026-105133 — A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44.
  • GHSA-9993-rfwp-rhwf — ZITADEL: MFA bypass via session reuse in Login V2
  • GHSA-8gpw-xvpf-hvx5 — phpMyFAQ's two-factor authentication login bypasses the password factor
  • GHSA-wrhw-j3f9-8vc6 — [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
  • GHSA-fj9w-c36g-h5x8 — AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

All advisories for CWE-287

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor