The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
96 vulnerabilities with CWE-303
CVE-2025-66489
CRITICAL
Cal.com < 5.9.8 - Authentication Bypass via TOTP Code
CVSS 9.8
CVE-2025-13390
CRITICAL
WP Directory Kit <= 1.4.4 - Unauthenticated Authentication Bypass via Weak Auto-Login Token
CVSS 10.0
CVE-2025-12421
CRITICAL
Mattermost <11.0.2, 10.12.1, 10.11.4, 10.5.12 - Auth Bypass
CVSS 9.9
CVE-2025-12419
CRITICAL
Mattermost <10.12.1, 10.11.4, 10.5.12, 11.0.3 - Open Redirect
CVSS 9.9
CVE-2025-63210
CRITICAL
Newtec Celox UHD CELOXA504 and CELOXA820 Firmware - Authentication Bypass via /celoxservice Response Injection
CVSS 9.8
CVE-2025-53782
HIGH
Microsoft Exchange Server - Privilege Escalation
CVSS 8.4
CVE-2025-61783
MEDIUM
Python Social Auth <5.6.0 - Info Disclosure
CVE-2025-43727
HIGH
Dell PowerProtect Data Domain - Auth Bypass
CVSS 7.5
CVE-2025-57808
HIGH
ESPHome < 2025.8.1 - Unauthenticated Authentication Bypass via Empty or Substring Authorization Header
CVSS 8.1
CVE-2025-8881
MEDIUM
Google Chrome < 139.0.7258.127 - Cross-Origin Data Leak via File Picker
CVSS 6.5
CVE-2025-43856
HIGH
immich < 1.132.0 - Account Hijacking via OAuth2 State Parameter Mismatch
CVE-2025-44557
HIGH
Cypress PSoC4 v3.66 - Authentication Bypass via Crafted Pairing Failed Packet
CVSS 8.1
CVE-2025-48994
MEDIUM
SignXML <4.0.4 - Algorithm Confusion
CVE-2025-3230
MEDIUM
Mattermost <10.7.0-10.6.2-10.5.3-9.11.12 - Info Disclosure
CVSS 5.4
CVE-2025-2571
MEDIUM
Mattermost <10.7.0-10.5.3-9.11.12 - Auth Bypass
CVSS 4.2
CVE-2025-2475
MEDIUM
Mattermost <10.5.1-10.4.3-9.11.9 - Info Disclosure
CVSS 5.4
CVE-2025-23046
HIGH
GLPI 9.5.0-10.0.17 - Authentication Bypass via OauthIMAP Plugin
CVSS 7.5
CVE-2025-21311
CRITICAL
Windows NTLM < - Privilege Escalation
CVSS 9.8
CVE-2024-8314
MEDIUM
B&R APROL <4.4-00P5 - Privilege Escalation
CVE-2024-56128
MEDIUM
Apache Kafka 0.10.2.0-3.9.0 - Authentication Bypass via SCRAM Nonce Validation Omission
CVSS 5.3
CVE-2024-52586
MEDIUM
elabftw 4.6.0-5.1.8 - Multifactor Authentication Bypass via Local Authentication
CVSS 5.4
CVE-2024-10127
CRITICAL
M-Files Server < 24.11 - Authentication Bypass via LDAP Configuration
CVSS 9.8
CVE-2024-9999
MEDIUM
WS_FTP Server < 8.8.9 - Incorrect Implementation of Authentication Algorithm in Web Transfer Module
CVSS 6.5
CVE-2024-36250
LOW
Mattermost <9.11.3-9.5.11 - Info Disclosure
CVSS 3.1
CVE-2024-10214
LOW
Mattermost <9.11.2-9.5.10 - Info Disclosure
CVSS 3.5
Details
Vulnerabilities
96