Common Weakness Enumeration
CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
300 vulnerabilities reference this CWE, most recent first.
GHSA-GG33-RW42-3HW7
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2023-09-14 18:32
VLAI
Details
A flaw was found in Samba, all versions starting samba 4.5.0 until samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2019-14833"
],
"database_specific": {
"cwe_ids": [
"CWE-305",
"CWE-521"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-06T10:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Samba, all versions starting samba 4.5.0 until samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.",
"id": "GHSA-gg33-rw42-3hw7",
"modified": "2023-09-14T18:32:37Z",
"published": "2022-05-24T22:01:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14833"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14833"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD"
},
{
"type": "WEB",
"url": "https://www.samba.org/samba/security/CVE-2019-14833.html"
},
{
"type": "WEB",
"url": "https://www.synology.com/security/advisory/Synology_SA_19_35"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GP88-9WRC-JXF5
Vulnerability from github – Published: 2025-12-26 15:30 – Updated: 2025-12-26 15:30
VLAI
Details
IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-13915"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-26T14:15:58Z",
"severity": "CRITICAL"
},
"details": "IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.",
"id": "GHSA-gp88-9wrc-jxf5",
"modified": "2025-12-26T15:30:17Z",
"published": "2025-12-26T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13915"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7255149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H332-G3FR-X4PF
Vulnerability from github – Published: 2024-07-20 09:30 – Updated: 2024-07-20 09:30
VLAI
Details
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2024-6637"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-20T08:15:16Z",
"severity": "HIGH"
},
"details": "The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.",
"id": "GHSA-h332-g3fr-x4pf",
"modified": "2024-07-20T09:30:36Z",
"published": "2024-07-20T09:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6637"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10d92d5e-1c23-4f6a-bfab-0756876190a5?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H5X7-XVX7-3C6R
Vulnerability from github – Published: 2025-10-22 06:31 – Updated: 2025-10-22 06:31
VLAI
Details
On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-62772"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-22T04:16:08Z",
"severity": "LOW"
},
"details": "On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.",
"id": "GHSA-h5x7-xvx7-3c6r",
"modified": "2025-10-22T06:31:11Z",
"published": "2025-10-22T06:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62772"
},
{
"type": "WEB",
"url": "https://blog.nullvoid.me/posts/mercku-exploits"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2025/Oct/10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HG48-698Q-829J
Vulnerability from github – Published: 2026-03-03 21:31 – Updated: 2026-03-09 18:31
VLAI
Details
Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming configuration. and could even disable the ASCG application or disable use of BSL data collection on Brocade switches within the fabric.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-0869"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-03T20:16:45Z",
"severity": "HIGH"
},
"details": "Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming configuration. and could even disable the ASCG application or disable use of BSL data collection on Brocade switches within the fabric.",
"id": "GHSA-hg48-698q-829j",
"modified": "2026-03-09T18:31:36Z",
"published": "2026-03-03T21:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0869"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/37121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HHJ7-6JP7-94J9
Vulnerability from github – Published: 2023-09-12 00:30 – Updated: 2023-09-12 00:30
VLAI
Details
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-4898"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-12T00:15:09Z",
"severity": "HIGH"
},
"details": "Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.",
"id": "GHSA-hhj7-6jp7-94j9",
"modified": "2023-09-12T00:30:26Z",
"published": "2023-09-12T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4898"
},
{
"type": "WEB",
"url": "https://github.com/mintplex-labs/anything-llm/commit/dc3dfbf31495fe316b21ee184b9317b38101d30e"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a3dda692-7e8a-44a9-bd96-24cfd3f721d2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQM6-P3V5-X59R
Vulnerability from github – Published: 2025-11-19 21:31 – Updated: 2025-11-21 00:30
VLAI
Details
A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share codes.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-51663"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-19T20:15:53Z",
"severity": "HIGH"
},
"details": "A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share codes.",
"id": "GHSA-hqm6-p3v5-x59r",
"modified": "2025-11-21T00:30:21Z",
"published": "2025-11-19T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51663"
},
{
"type": "WEB",
"url": "https://github.com/vastsa/FileCodeBox/issues/350"
},
{
"type": "WEB",
"url": "https://github.com/vastsa/FileCodeBox"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HRM3-3XM6-X33H
Vulnerability from github – Published: 2022-12-28 00:30 – Updated: 2023-01-10 15:49
VLAI
Summary
golang-nanoauth authentication bypass vulnerability
Details
Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/nanobox-io/golang-nanoauth"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-20160722212129-ac0cc4484ad4"
},
{
"fixed": "0.0.0-20200131131040-063a3fb69896"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36569"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T18:54:51Z",
"nvd_published_at": "2022-12-27T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.",
"id": "GHSA-hrm3-3xm6-x33h",
"modified": "2023-01-10T15:49:55Z",
"published": "2022-12-28T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36569"
},
{
"type": "WEB",
"url": "https://github.com/nanobox-io/golang-nanoauth/pull/5"
},
{
"type": "WEB",
"url": "https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3"
},
{
"type": "PACKAGE",
"url": "https://github.com/nanobox-io/golang-nanoauth"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2020-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "golang-nanoauth authentication bypass vulnerability"
}
GHSA-HRMX-8JJV-G758
Vulnerability from github – Published: 2024-08-01 21:31 – Updated: 2024-08-07 19:38
VLAI
Summary
Navidrome uses MD5 hashing algorithm
Details
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/navidrome/navidrome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.52.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41259"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-305",
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T13:25:53Z",
"nvd_published_at": "2024-08-01T21:15:36Z",
"severity": "MODERATE"
},
"details": "Use of insecure hashing algorithm in the Gravatar\u0027s service in Navidrome v0.52.3 allows attackers to manipulate a user\u0027s account information.",
"id": "GHSA-hrmx-8jjv-g758",
"modified": "2024-08-07T19:38:27Z",
"published": "2024-08-01T21:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41259"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/d192af10b53a363e2d9e430068333e04"
},
{
"type": "PACKAGE",
"url": "https://github.com/navidrome/navidrome"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Navidrome uses MD5 hashing algorithm"
}
GHSA-HVM9-WC8J-MGRC
Vulnerability from github – Published: 2024-12-18 18:19 – Updated: 2024-12-18 18:19
VLAI
Summary
TShock Security Escalation Exploit
Details
Impact
An issue with the way OTAPI manages client connections results in stale UUIDs remaining on RemoteClient instances after a player disconnects.
Because of this, if the following conditions are met a player may assume the login state of a previously connected player:
1. The server has UUID login enabled
2. An authenticated player disconnects
3. A subsequent player connects with a modified client that does not send the ClientUUID#68 packet during connection
4. The server assigns the same RemoteClient object that belonged to the originally authenticated player to the newly connected player
Patches
TShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.
Workarounds
Implement a RemoteClient reset event handler in a plugin like so:
public override void Initialize()
{
On.Terraria.RemoteClient.Reset += RemoteClient_Reset;
}
private static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)
{
client.ClientUUID = null;
orig(client);
}
Severity
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "TShock"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.21"
},
{
"fixed": "5.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-305",
"CWE-613",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-18T18:19:12Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n orig(client);\n}\n```\n\n",
"id": "GHSA-hvm9-wc8j-mgrc",
"modified": "2024-12-18T18:19:12Z",
"published": "2024-12-18T18:19:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Pryaxis/TShock/security/advisories/GHSA-hvm9-wc8j-mgrc"
},
{
"type": "WEB",
"url": "https://github.com/Pryaxis/TShock/commit/5075997264b48e27960e3446a948ecb0ea0f5a03"
},
{
"type": "PACKAGE",
"url": "https://github.com/Pryaxis/TShock"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "TShock Security Escalation Exploit"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.