CWE-302 · 39 records

Authentication Bypass by Assumed-Immutable Data

CVEs in this class

39 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
61This week	CVE-2024-43441Proof of concept	Apache HugeGraph-Server: Fixed JWT Token(Secret)apache · hugegraph · CWE-302 Pre-auth Auth bypass	Critical9.8	—	72.8%	Dec 24, 2024
40Plan	CVE-2016-9482No exploit	PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypassjqueryform · php formmail generator · CWE-302 Pre-auth Auth bypass	Critical9.8	—	4.5%	Jul 13, 2018
40Plan	CVE-2025-29813No exploit	Azure DevOps Elevation of Privilege Vulnerabilitymicrosoft · azure devops · CWE-302 Pre-auth Auth bypass	Critical9.8	—	1.8%	May 8, 2025
39Monitor	CVE-2024-4024No exploit	Authentication Bypass by Assumed-Immutable Data in GitLabgitlab · gitlab · CWE-302 Auth bypass	High8.8	—	14.9%	Apr 25, 2024
39Monitor	CVE-2023-4669No exploit	Authentication Bypass in Exagate SYSGuard 3001exagate · sysguard 3001 firmware · CWE-302 Pre-auth Auth bypass	Critical9.8	—	1.2%	Sep 14, 2023
39Monitor	CVE-2023-4612No exploit	MFA bypass in Apereo CASapereo · central authentication service · CWE-302 Pre-auth Auth bypass	Critical9.8	—	0.9%	Nov 9, 2023
39Monitor	CVE-2024-56404No exploit	In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation.oneidentity · identity manager · CWE-302 Auth bypass Broken access control (IDOR)	Critical9.9	—	0.7%	Jan 24, 2025
39Monitor	CVE-2026-48781No exploit	Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgerygitroomhq · postiz-app · CWE-302 Auth bypass	Critical9.9	—	0.3%	Jun 17, 2026
36Monitor	CVE-2025-47158No exploit	Azure DevOps Server Elevation of Privilege Vulnerabilitymicrosoft · azure devops · CWE-302 Pre-auth Auth bypass	Critical9.0	—	0.8%	Jul 18, 2025
36Monitor	CVE-2026-39429No exploit	kcp's cache server is accessible without authentication or authorization checkskcp · kcp · CWE-302 Pre-auth Auth bypass	Critical9.1	—	0.5%	Apr 8, 2026
35Monitor	CVE-2024-49056No exploit	Airlift.microsoft.com Elevation of Privilege Vulnerabilitymicrosoft · airlift microsoft com · CWE-302 Auth bypass	High8.8	—	1.0%	Nov 12, 2024
35Monitor	CVE-2022-22729No exploit	CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets.yokogawa · centum cs 3000 firmware · CWE-302 Auth bypass	High8.8	—	0.9%	Mar 11, 2022
35Monitor	CVE-2024-12838No exploit	Changing Information Technology CGFIDO - Authentication Bypasschanging information technology · cgfido · CWE-302 Auth bypass	High8.8	—	0.8%	Dec 30, 2024
34Monitor	CVE-2024-3741No exploit	Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Dataelectrolink · compact dab transmitter · CWE-302 Pre-auth Auth bypass	High8.7	—	0.5%	Apr 18, 2024
34Monitor	CVE-2024-47086No exploit	OTP Bypass Vulnerabilityapexsoftcell · ld geo · CWE-302 Pre-auth Auth bypass	High8.7	—	0.5%	Sep 19, 2024
34Monitor	CVE-2024-22179No exploit	Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Dataelectrolink · compact dab transmitter · CWE-302 Pre-auth Auth bypass	High8.7	—	0.4%	Apr 18, 2024
32Monitor	CVE-2026-50528No exploit	.NET Security Feature Bypass Vulnerabilitymicrosoft · .net · CWE-302 Pre-auth Auth bypass	High8.2	—	0.6%	Jul 14, 2026
32Monitor	CVE-2026-5423No exploit	Subscription Authentication Bypass via Unverified connectionParams.jwtneo4j · graphql · CWE-302 Pre-auth Auth bypass	High8.2	—	0.6%	Aug 6, 2026
32Monitor	CVE-2025-24876No exploit	Authentication bypass via authorization code injection in SAP Approutersap_se · sap approuter node.js package · CWE-302 pre-auth RCE Auth bypass	High8.1	—	0.5%	Feb 10, 2025
32Monitor	CVE-2025-8855No exploit	2FA Expiry Bypass in Optimus Software's Brokerage Automationoptimus software · brokerage automation · CWE-302 Auth bypass	High8.1	—	0.4%	Nov 14, 2025
32Monitor	CVE-2026-13267No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-302 Auth bypass	High8.1	—	0.4%	Aug 12, 2026
30Monitor	CVE-2020-15074No exploit	OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens openvpn · openvpn access server · CWE-302 Pre-auth Auth bypass	High7.5	—	1.0%	Jul 14, 2020
30Monitor	CVE-2022-3875No exploit	Click Studios Passwordstate API authentication bypass by assumed-immutable dataclickstudios · passwordstate · CWE-302 Pre-auth Auth bypass	High7.5	—	1.0%	Dec 19, 2022
30Monitor	CVE-2025-26522No exploit	Authentication Bypass Vulnerability in RupeeWeb trading platformrupeeseed technology ventures · rupeeweb · CWE-302 Auth bypass	High7.5	—	0.4%	Feb 14, 2025
29Monitor	CVE-2024-45370No exploit	An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0.socomec · easy config system · CWE-302 Auth bypass	High7.3	—	0.2%	Dec 1, 2025

CVE-2024-43441
61This week
Apache HugeGraph-Server: Fixed JWT Token(Secret)
CriticalCVSS 9.8Proof of conceptEPSS 73%
- Pre-auth
- Auth bypass
apache · hugegraphDec 24, 2024
CVE-2016-9482
40Plan
PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass
CriticalCVSS 9.8No exploitEPSS 4%
- Pre-auth
- Auth bypass
jqueryform · php formmail generatorJul 13, 2018
CVE-2025-29813
40Plan
Azure DevOps Elevation of Privilege Vulnerability
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
- Auth bypass
microsoft · azure devopsMay 8, 2025
CVE-2024-4024
39Monitor
Authentication Bypass by Assumed-Immutable Data in GitLab
HighCVSS 8.8No exploitEPSS 15%
- Auth bypass
gitlab · gitlabApr 25, 2024
CVE-2023-4669
39Monitor
Authentication Bypass in Exagate SYSGuard 3001
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
exagate · sysguard 3001 firmwareSep 14, 2023
CVE-2023-4612
39Monitor
MFA bypass in Apereo CAS
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
apereo · central authentication serviceNov 9, 2023
CVE-2024-56404
39Monitor
In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation.
CriticalCVSS 9.9No exploitEPSS 1%
- Auth bypass
- Broken access control (IDOR)
oneidentity · identity managerJan 24, 2025
CVE-2026-48781
39Monitor
Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery
CriticalCVSS 9.9No exploitEPSS 0%
- Auth bypass
gitroomhq · postiz-appJun 17, 2026
CVE-2025-47158
36Monitor
Azure DevOps Server Elevation of Privilege Vulnerability
CriticalCVSS 9.0No exploitEPSS 1%
- Pre-auth
- Auth bypass
microsoft · azure devopsJul 18, 2025
CVE-2026-39429
36Monitor
kcp's cache server is accessible without authentication or authorization checks
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Auth bypass
kcp · kcpApr 8, 2026
CVE-2024-49056
35Monitor
Airlift.microsoft.com Elevation of Privilege Vulnerability
HighCVSS 8.8No exploitEPSS 1%
- Auth bypass
microsoft · airlift microsoft comNov 12, 2024
CVE-2022-22729
35Monitor
CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets.
HighCVSS 8.8No exploitEPSS 1%
- Auth bypass
yokogawa · centum cs 3000 firmwareMar 11, 2022
CVE-2024-12838
35Monitor
Changing Information Technology CGFIDO - Authentication Bypass
HighCVSS 8.8No exploitEPSS 1%
- Auth bypass
changing information technology · cgfidoDec 30, 2024
CVE-2024-3741
34Monitor
Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
electrolink · compact dab transmitterApr 18, 2024
CVE-2024-47086
34Monitor
OTP Bypass Vulnerability
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
apexsoftcell · ld geoSep 19, 2024
CVE-2024-22179
34Monitor
Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
electrolink · compact dab transmitterApr 18, 2024
CVE-2026-50528
32Monitor
.NET Security Feature Bypass Vulnerability
HighCVSS 8.2No exploitEPSS 1%
- Pre-auth
- Auth bypass
microsoft · .netJul 14, 2026
CVE-2026-5423
32Monitor
Subscription Authentication Bypass via Unverified connectionParams.jwt
HighCVSS 8.2No exploitEPSS 1%
- Pre-auth
- Auth bypass
neo4j · graphqlAug 6, 2026
CVE-2025-24876
32Monitor
Authentication bypass via authorization code injection in SAP Approuter
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
sap_se · sap approuter node.js packageFeb 10, 2025
CVE-2025-8855
32Monitor
2FA Expiry Bypass in Optimus Software's Brokerage Automation
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
optimus software · brokerage automationNov 14, 2025
CVE-2026-13267
32Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
ibm · security verify accessAug 12, 2026
CVE-2020-15074
30Monitor
OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
openvpn · openvpn access serverJul 14, 2020
CVE-2022-3875
30Monitor
Click Studios Passwordstate API authentication bypass by assumed-immutable data
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Auth bypass
clickstudios · passwordstateDec 19, 2022
CVE-2025-26522
30Monitor
Authentication Bypass Vulnerability in RupeeWeb trading platform
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
rupeeseed technology ventures · rupeewebFeb 14, 2025
CVE-2024-45370
29Monitor
An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0.
HighCVSS 7.3No exploitEPSS 0%
- Auth bypass
socomec · easy config systemDec 1, 2025

All vulnerability classes