CWE-305: Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Consequences

• Access Control: Bypass Protection Mechanism

Recent advisories

• GHSA-45gv-9wjv-xh7p — Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
• EEF-CVE-2026-85500 — `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
• CVE-2026-81578 — An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG.
• GHSA-vx8h-4prv-g744 — Rancher has Privilege Escalation from Project Owner to Host
• GHSA-q6h7-xxp7-7429 — Keycloak has an Authentication Bypass by Primary Weakness
• GHSA-jp3f-x449-4q75 — Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow
• GHSA-75cm-x2w3-8mgf — MLflow: unauthenticated access to certain FastAPI routes
• GHSA-phrq-pc6r-f6gh — MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
• GHSA-v9xm-ffx2-7h35 — ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware
• GHSA-4v8w-gg5j-ph37 — MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
• GHSA-7xwp-2cpp-p8r7 — File Browser’s insecure JWT handling can lead to session replay attacks after logout
• GHSA-3v48-283x-f2w4 — File Browser's password protection of links is bypassable
• CVE-2025-31161 — CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as…
• CVE-2024-37085 — VMware ESXi contains an authentication bypass vulnerability.
• GHSA-93x3-m7pw-ppqm — Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process

All advisories for CWE-305