Common Weakness Enumeration
CWE-603
AllowedUse of Client-Side Authentication
Abstraction: Base · Status: Draft
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
45 vulnerabilities reference this CWE, most recent first.
GHSA-PCRM-W585-FVG9
Vulnerability from github – Published: 2024-10-25 09:32 – Updated: 2024-10-25 09:32
VLAI
Details
MUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability is exploited, other users' credential and sensitive information may be retrieved.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-45785"
],
"database_specific": {
"cwe_ids": [
"CWE-603"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T08:15:02Z",
"severity": "HIGH"
},
"details": "MUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability is exploited, other users\u0027 credential and sensitive information may be retrieved.",
"id": "GHSA-pcrm-w585-fvg9",
"modified": "2024-10-25T09:32:01Z",
"published": "2024-10-25T09:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45785"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN31982676"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RFWF-H4FR-XR3G
Vulnerability from github – Published: 2026-03-02 12:30 – Updated: 2026-03-09 18:31
VLAI
Details
The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-30042"
],
"database_specific": {
"cwe_ids": [
"CWE-603"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-02T12:16:01Z",
"severity": "CRITICAL"
},
"details": "The CGM CLININET system provides smart card authentication; however, authentication is conducted locally on the client device, and, in reality, only the certificate number is used for access verification. As a result, possession of the certificate number alone is sufficient for authentication, regardless of the actual presence of the smart card or ownership of the private key.",
"id": "GHSA-rfwf-h4fr-xr3g",
"modified": "2026-03-09T18:31:36Z",
"published": "2026-03-02T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30042"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2026/03/CVE-2025-10350"
},
{
"type": "WEB",
"url": "https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-RJ7P-436Q-6XV2
Vulnerability from github – Published: 2026-08-28 00:32 – Updated: 2026-08-28 00:32
VLAI
Details
The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-71187"
],
"database_specific": {
"cwe_ids": [
"CWE-603"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T00:18:09Z",
"severity": "CRITICAL"
},
"details": "The Ebyte device relies on client side authentication logic that can be \nreproduced by unauthenticated users. An attacker may generate valid \nauthentication requests and bypass authentication to obtain \nadministrative access to the device.",
"id": "GHSA-rj7p-436q-6xv2",
"modified": "2026-08-28T00:32:03Z",
"published": "2026-08-28T00:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71187"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-06.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WJC9-9JQG-MCQ7
Vulnerability from github – Published: 2025-10-17 21:31 – Updated: 2025-10-18 03:30
VLAI
Details
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
Severity
8.3 (High)
{
"affected": [],
"aliases": [
"CVE-2025-62650"
],
"database_specific": {
"cwe_ids": [
"CWE-603"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-17T21:15:38Z",
"severity": "HIGH"
},
"details": "The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.",
"id": "GHSA-wjc9-9jqg-mcq7",
"modified": "2025-10-18T03:30:25Z",
"published": "2025-10-17T21:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62650"
},
{
"type": "WEB",
"url": "https://archive.today/fMYQp"
},
{
"type": "WEB",
"url": "https://bobdahacker.com/blog/rbi-hacked-drive-thrus"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus"
},
{
"type": "WEB",
"url": "https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers"
},
{
"type": "WEB",
"url": "https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-WXX6-J873-V2QH
Vulnerability from github – Published: 2025-01-23 18:31 – Updated: 2025-01-23 18:31
VLAI
Details
The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-52327"
],
"database_specific": {
"cwe_ids": [
"CWE-603"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-23T17:15:13Z",
"severity": "MODERATE"
},
"details": "The cloud service used by ECOVACS robot lawnmowers and vacuums allows authenticated attackers to bypass the PIN entry required to access the live video feed.",
"id": "GHSA-wxx6-j873-v2qh",
"modified": "2025-01-23T18:31:20Z",
"published": "2025-01-23T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52327"
},
{
"type": "WEB",
"url": "https://dontvacuum.me/talks/37c3-2023/37c3-vacuuming-and-mowing.pdf"
},
{
"type": "WEB",
"url": "https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.pdf"
},
{
"type": "WEB",
"url": "https://www.ecovacs.com/global/userhelp/dsa20241217002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
Do not rely on client side data. Always perform server side authentication.
No CAPEC attack patterns related to this CWE.