CWE-303: Incorrect Implementation of Authentication Algorithm

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

This incorrect implementation may allow authentication to be bypassed.

Consequences

• Access Control: Bypass Protection Mechanism

Recent advisories

• GHSA-wrhw-j3f9-8vc6 — [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token
• GHSA-4j6x-2764-m8gh — Rancher has over-inclusive team membership expansion in GitHub App authentication provider
• GHSA-4jcj-7x88-m979 — LiteLLM: MCP Proxy Has Improper Authentication
• GHSA-x527-x647-q7gg — golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
• GHSA-83c4-ffjp-mxp9 — Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured
• GHSA-vp29-5652-4fw9 — CoreDNS has TSIG authentication bypass on gRPC and QUIC transports
• GHSA-qhmp-q7xh-99rh — CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC
• GHSA-fg35-5rf6-qg3g — Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw
• GHSA-4rj2-gpmh-qq5x — OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)
• GHSA-3c9r-7f29-qp32 — Mattermost fails to properly validate login method restrictions
• GO-2026-4275 — Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm
• GHSA-mp6x-97xj-9x62 — Mattermost fails to to verify the token used during code exchange
• GHSA-3x39-62h4-f8j6 — Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
• GO-2025-3731 — Mattermost fails to properly invalidate personal access tokens upon user deactivation
• GO-2025-3729 — Mattermost fails to clear Google OAuth credentials

All advisories for CWE-303