CWE-287

{
  "affected": [],
  "aliases": [
    "CVE-2018-16286"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-14T21:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits.",
  "id": "GHSA-qc57-qhfx-p8p2",
  "modified": "2022-05-14T02:01:42Z",
  "published": "2022-05-14T02:01:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16286"
    },
    {
      "type": "WEB",
      "url": "http://mamaquieroserpentester.blogspot.com/2018/09/multiple-vulnerabilities-in-lg.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.0.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-12160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-25T23:36:36Z",
    "nvd_published_at": "2017-10-26T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.",
  "id": "GHSA-qc72-gfvw-76h7",
  "modified": "2023-10-10T14:39:13Z",
  "published": "2022-05-13T01:23:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12160"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:2904"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:2905"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:2906"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1484154"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keycloak Oauth Implementation Error"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3652"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-18T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.",
  "id": "GHSA-qc73-mcqm-3m29",
  "modified": "2025-11-03T21:30:38Z",
  "published": "2022-04-19T00:00:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3652"
    },
    {
      "type": "WEB",
      "url": "https://github.com/389ds/389-ds-base/issues/4817"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982782"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00015.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2013-3092"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-09-29T22:55:00Z",
    "severity": "HIGH"
  },
  "details": "The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via vectors related to incorrect validation of the HTTP Authorization header.",
  "id": "GHSA-qcgx-q6p2-g27p",
  "modified": "2022-05-17T04:32:24Z",
  "published": "2022-05-17T04:32:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3092"
    },
    {
      "type": "WEB",
      "url": "http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf"
    },
    {
      "type": "WEB",
      "url": "http://securityevaluators.com/knowledge/case_studies/routers/belkin_n900.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-35903"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-27T19:16:52Z",
    "severity": "CRITICAL"
  },
  "details": "MERCURY MIPC252W IP camera 1.0.5 Build 230306 Rel.79931n contains an improper authentication vulnerability in the RTSP service. After successful Digest authentication in an initial DESCRIBE request, the device does not verify the Digest response parameter in subsequent RTSP requests within the same session. As a result, RTSP methods such as SETUP, PLAY, and TEARDOWN can be processed even when the Authorization header contains an empty or invalid response value, as long as the nonce and session identifier correspond to a previously authenticated session. This allows an attacker with network access to reuse session parameters and issue unauthorized RTSP control commands without computing a valid Digest response.",
  "id": "GHSA-qcq4-vpjf-wxhh",
  "modified": "2026-04-28T18:30:30Z",
  "published": "2026-04-27T21:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35903"
    },
    {
      "type": "WEB",
      "url": "https://github.com/izxnfirh8148/CVE_REQUESTS_references/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_4th/README.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-09T17:16:57Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhooks. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-qcqf-phv4-c959",
  "modified": "2026-07-09T18:31:51Z",
  "published": "2026-07-09T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15192"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mettle/sendportal/issues/340"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mettle/sendportal"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-15192"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/851624"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377118"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377118/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-45434"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-19T10:16:24Z",
    "severity": "HIGH"
  },
  "details": "Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution\n\nThis issue affects Apache OFBiz: before 24.09.06.\n\nUsers are recommended to upgrade to version 24.09.06, which fixes the issue.",
  "id": "GHSA-qcxg-xcph-9r99",
  "modified": "2026-05-19T21:32:03Z",
  "published": "2026-05-19T12:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45434"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/yw4owrzl0yho1yx7oqxvr6xjkmln9tq8"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/19/29"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-107350"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-14T18:17:25Z",
    "severity": "HIGH"
  },
  "details": "Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.",
  "id": "GHSA-qcxp-3cx5-3f3g",
  "modified": "2026-10-14T18:32:29Z",
  "published": "2026-10-14T18:32:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107350"
    },
    {
      "type": "WEB",
      "url": "https://www.pgbouncer.org/changelog.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.20.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.21.0.CR1"
            },
            {
              "fixed": "3.27.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.28.0.CR1"
            },
            {
              "fixed": "3.33.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.34.0.CR1"
            },
            {
              "fixed": "3.36.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.37.0.CR1"
            },
            {
              "fixed": "3.37.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-178",
      "CWE-287",
      "CWE-41",
      "CWE-551",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T15:40:05Z",
    "nvd_published_at": "2026-06-19T21:17:02Z",
    "severity": "HIGH"
  },
  "details": "Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix\n  parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static\n  resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.\n\n  ### Technical Details\n\n  The security layer (AbstractPathMatchingHttpSecurityPolicy) normalizes request paths using Vert.x\u0027s normalizedPath(),\n  which only decodes unreserved RFC 3986 characters (letters, digits, -, ., _, ~). It then strips matrix parameters by\n  looking for literal ; characters. This creates two mismatches:\n\n  1. Encoded semicolons (`%3B`): Since `%3B` is not decoded by normalizedPath(), the matrix parameter stripping in\n  pathWithoutMatrixParams() never sees it. The encoded semicolon and everything after it become part of the path\n  segment, causing policy matching to fail. This affects all path-policy-protected endpoints.\n  2. Static resource path mismatch: Static resource handlers (StaticHandlerImpl, FileSystemStaticHandler) perform full\n  percent-decoding via URIDecoder.decodeURIComponent() and backslash-to-slash conversion before filesystem resolution.\n  Reserved characters like `%2F` (slash) and `%5C` (backslash) that survive the security layer\u0027s partial decoding are fully\n  decoded before file serving.\n\n  REST endpoints using Quarkus REST (RESTEasy Reactive) are not affected by the `%2F/%5C` vectors because the routing layer also uses `normalizedPath()` \u2014 both security and routing agree on the path, so no mismatch exists.\n\n###  Attack Vectors\n\n  Encoded semicolon (matrix parameter smuggling), affects all path-policy-protected endpoints:\n  \n  - `/api/admin%3Bbypass=true/data`: security sees this as a single segment `admin%3Bbypass=true`, which does not match the\n   `/api/admin/* policy`. The request passes through unauthenticated.\n  - `/api/secret%3b/data`: same mechanism with lowercase hex digit.\n\n  Encoded slash/backslash on static resources, affects static files behind path policies:\n  - `/static-secret%2Fhtml`, security does not match /static-secret.html policy; static handler decodes `%2F` to `/` and may\n  resolve the file.\n  - `/static-secret%5Chtml `. static handler decodes `%5C` to `\\`, then converts to `/`.\n\n  Double encoding, affects static resources:\n  - `/secret%252Fconfidential.html`, first decode by normalizedPath() turns `%25` into `%`, producing `%2F`. Static handler\u0027s\n  second decode turns `%2F` into `/`.\n\n  The following vectors were investigated and confirmed not exploitable:\n\n  - Unreserved character encoding (`/api/adm%69n/data`): `normalizedPath()` decodes these. Both security and routing see\n  `/api/admin/data`. \n  - Null byte injection (`/api/admin%00/data`): `%00` is not decoded by `normalizedPath()`. \n  - Encoded dot segments (`/api/%2e%2e/secret/data`): Period is unreserved, so `%2e` is decoded to `.` by `normalizedPath()`,\n  then `removeDots()` normalizes `..` segments. \n  - REST endpoint bypass via `%2F/%5C`: Routing uses the same `normalizedPath()` as security. The encoded slash/backslash\n  doesn\u0027t match any route. \n\n###   Root Cause\n\n  `pathWithoutMatrixParams()` operates on the partially-decoded output of `normalizedPath()`, where reserved characters\n  remain encoded. It searches for literal ; but never sees `%3B.` The fix (`normalizePath()`) performs full percent-decoding\n   in a loop before stripping matrix parameters, removing null bytes, normalizing backslashes, and resolving dot\n  segments, aligning the security layer\u0027s view of the path with what downstream handlers resolve.\n\n###  Impact\n\n  - Unauthenticated access to endpoints protected by `quarkus.http.auth.permission` path-based policies via `%3B` smuggling\n  - Static resource exposure by bypassing path policies on protected files via `%2F/%5C`\n  - Applications using annotation-based security (`@RolesAllowed`, `@Authenticated`) on JAX-RS resources without path-based\n  policies are not affected by the `%2F/%5C` vectors, but may still be affected by `%3B` if path policies coexist\n\n###  Proof of Concept\n\n```\n  # Encoded semicolon bypass \u2014 works on any path-policy-protected endpoint\n  # Security sees \"/api/admin%3Bbypass=true/data\", doesn\u0027t match /api/admin/* policy\n  curl -v http://target/api/admin%3Bbypass=true/data\n\n  # Encoded semicolon on authenticated endpoint\n  curl -v http://target/api/secret%3b/data\n\n  # Static resource bypass via encoded slash (if static file behind path policy)\n  curl -v http://target/static-secret%2Fhtml\n\n  # Static resource bypass via encoded backslash\n  curl -v http://target/static-secret%5Chtml\n```",
  "id": "GHSA-qcxp-gm7m-4j5v",
  "modified": "2026-07-30T12:32:16Z",
  "published": "2026-07-29T15:40:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50559"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/commit/919b80017d85564143a845b38e9cca54aff5b3cc"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:26017"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:26018"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:26194"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:26586"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34608"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36820"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:48151"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-50559"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486959"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quarkusio/quarkus"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-1006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-29T16:15:08Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_User_Id/Nod_User_Token leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252275. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-qcxp-xh47-3g32",
  "modified": "2024-01-29T18:31:49Z",
  "published": "2024-01-29T18:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1006"
    },
    {
      "type": "WEB",
      "url": "https://note.zhaoj.in/share/vWuVlU2eg79t"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.252275"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.252275"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}