CWE-304 · 40 records

Missing Critical Step in Authentication

CVEs in this class

40 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2022-2302No exploit	LENZE: Missing password verification in authorisation procedurelenze · c520 firmware · CWE-304 Pre-auth	Critical9.8	—	2.1%	Jul 11, 2022
40Plan	CVE-2024-2172No exploit	Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalationcyberlord92 · web application firewall – website security · CWE-304 Pre-auth	Critical9.8	—	1.7%	Mar 13, 2024
39Monitor	CVE-2011-3172No exploit	unix2_chkpwd do not check for a valid accountsuse · suse linux enterprise server · CWE-304 Pre-auth	Critical9.8	—	1.0%	Jun 8, 2018
39Monitor	CVE-2024-8954No exploit	Authentication Bypass in composiohq/composiocomposio · composio · CWE-304 Pre-auth Auth bypass	Critical9.8	—	0.9%	Mar 20, 2025
39Monitor	CVE-2025-24322No exploit	An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110.tenda · ac6 firmware · CWE-304 pre-auth RCE	Critical9.8	—	0.6%	Aug 20, 2025
39Monitor	CVE-2024-45764No exploit	Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability.dell · enterprise sonic distribution · CWE-304 Pre-auth	Critical9.8	—	0.5%	Nov 8, 2024
38Monitor	CVE-2023-54391Proof of concept	Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameterproxmox server solutions gmbh · proxmox virtual environment (ve) · CWE-304 Pre-auth Auth bypass	Critical9.3	—	3.1%	Sep 1, 2026
36Monitor	CVE-2022-1065No exploit	Multi Factor Authentication Bypass in various versions of Abacus ERPabacus · abacus erp 2018 · CWE-304 Auth bypass	High8.8	—	2.9%	Apr 19, 2022
36Monitor	CVE-2026-61466No exploit	Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalationapache · cxf · CWE-304 Pre-auth	Critical9.1	—	0.7%	Aug 6, 2026
36Monitor	CVE-2026-59564No exploit	Authentication bypass between ZCC and client connector portalzscaler · client connector · CWE-304 Pre-auth Auth bypass	Critical9.1	—	0.5%	Aug 24, 2026
36Monitor	CVE-2026-94052No exploit	Apache MINA SSHD: LDAP password authentication ineffectiveapache software foundation · apache mina sshd · CWE-304 Pre-auth	Critical9.1	—	0.4%	Sep 30, 2026
35Monitor	CVE-2024-12048No exploit	IDOR Vulnerability in transformeroptimus/superagisuperagi · superagi · CWE-304 Broken access control (IDOR)	High8.8	—	0.7%	Mar 20, 2025
35Monitor	CVE-2022-40622No exploit	WAVLINK Quantum D4G (WN531G3) Session Management by IP Addresswavlink · wn531g3 firmware · CWE-304 Pre-auth	High8.8	—	0.7%	Sep 13, 2022
34Monitor	CVE-2026-67351No exploit	Serendipity < 2.6.1 Authentication Bypass via Username Collisions9y · serendipity · CWE-304 Auth bypass	High8.7	—	0.6%	Jul 30, 2026
34Monitor	CVE-2026-76207No exploit	phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookiephpmyfaq · phpmyfaq · CWE-304 Auth bypass	High8.6	—	0.5%	Aug 19, 2026
34Monitor	CVE-2026-108071No exploit	Improper Multi-Factor Authentication Validation Allows Authentication Bypasstsplus · tsplus remote access · CWE-304 Auth bypass	High8.7	—	—	1 day ago
32Monitor	CVE-2024-9216No exploit	Authentication Bypass in gaizhenbiao/ChuanhuChatGPTgaizhenbiao · chuanhuchatgpt · CWE-304 Auth bypass	High8.1	—	0.6%	Mar 20, 2025
32Monitor	CVE-2026-42452No exploit	Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTPtermix-ssh · termix · CWE-304	High8.1	—	0.4%	May 8, 2026
32Monitor	CVE-2026-93994No exploit	Apache MINA SSHD: Repeated-publickey policy bypass on serverapache software foundation · apache mina sshd · CWE-304 Auth bypass	High8.1	—	0.3%	Sep 30, 2026
32Monitor	CVE-2024-11302No exploit	Missing check_access in lollms_binding_infos in parisneo/lollmsparisneo · parisneo/lollms · CWE-304	High8.0	—	0.2%	Mar 20, 2025
32Monitor	CVE-2026-89068No exploit	MOVEit Transfer Authentication bypass in LDAP sign-onprogress · moveit transfer · CWE-304 Pre-auth Auth bypass	High8.1	—	—	Today
31Monitor	CVE-2024-12136No exploit	Improper Access Control in Elfatek Elektronics' ANKA JPD-00028elfatek · anka jpd00028 firmware · CWE-304 Auth bypass	High7.8	—	0.2%	Mar 19, 2025
30Monitor	CVE-2026-55957Proof of concept	Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bindapache · tomcat · CWE-304 Pre-auth Auth bypass	High7.3	—	2.9%	Jun 29, 2026
30Monitor	CVE-2022-2821No exploit	Missing Critical Step in Authentication in namelessmc/namelessnamelessmc · nameless · CWE-304 Pre-auth	High7.5	—	1.4%	Aug 15, 2022
30Monitor	CVE-2024-20153No exploit	In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID.linuxfoundation · yocto · CWE-304 Pre-auth	High7.5	—	0.3%	Jan 6, 2025

CVE-2022-2302
40Plan
LENZE: Missing password verification in authorisation procedure
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
lenze · c520 firmwareJul 11, 2022
CVE-2024-2172
40Plan
Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
cyberlord92 · web application firewall – website securityMar 13, 2024
CVE-2011-3172
39Monitor
unix2_chkpwd do not check for a valid account
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
suse · suse linux enterprise serverJun 8, 2018
CVE-2024-8954
39Monitor
Authentication Bypass in composiohq/composio
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
composio · composioMar 20, 2025
CVE-2025-24322
39Monitor
An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
tenda · ac6 firmwareAug 20, 2025
CVE-2024-45764
39Monitor
Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
dell · enterprise sonic distributionNov 8, 2024
CVE-2023-54391
38Monitor
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
CriticalCVSS 9.3Proof of conceptEPSS 3%
- Pre-auth
- Auth bypass
proxmox server solutions gmbh · proxmox virtual environment (ve)Sep 1, 2026
CVE-2022-1065
36Monitor
Multi Factor Authentication Bypass in various versions of Abacus ERP
HighCVSS 8.8No exploitEPSS 3%
- Auth bypass
abacus · abacus erp 2018Apr 19, 2022
CVE-2026-61466
36Monitor
Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
apache · cxfAug 6, 2026
CVE-2026-59564
36Monitor
Authentication bypass between ZCC and client connector portal
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Auth bypass
zscaler · client connectorAug 24, 2026
CVE-2026-94052
36Monitor
Apache MINA SSHD: LDAP password authentication ineffective
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache software foundation · apache mina sshdSep 30, 2026
CVE-2024-12048
35Monitor
IDOR Vulnerability in transformeroptimus/superagi
HighCVSS 8.8No exploitEPSS 1%
- Broken access control (IDOR)
superagi · superagiMar 20, 2025
CVE-2022-40622
35Monitor
WAVLINK Quantum D4G (WN531G3) Session Management by IP Address
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
wavlink · wn531g3 firmwareSep 13, 2022
CVE-2026-67351
34Monitor
Serendipity < 2.6.1 Authentication Bypass via Username Collision
HighCVSS 8.7No exploitEPSS 1%
- Auth bypass
s9y · serendipityJul 30, 2026
CVE-2026-76207
34Monitor
phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
phpmyfaq · phpmyfaqAug 19, 2026
CVE-2026-108071
34Monitor
Improper Multi-Factor Authentication Validation Allows Authentication Bypass
HighCVSS 8.7No exploit
- Auth bypass
tsplus · tsplus remote access1 day ago
CVE-2024-9216
32Monitor
Authentication Bypass in gaizhenbiao/ChuanhuChatGPT
HighCVSS 8.1No exploitEPSS 1%
- Auth bypass
gaizhenbiao · chuanhuchatgptMar 20, 2025
CVE-2026-42452
32Monitor
Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP
HighCVSS 8.1No exploitEPSS 0%
termix-ssh · termixMay 8, 2026
CVE-2026-93994
32Monitor
Apache MINA SSHD: Repeated-publickey policy bypass on server
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
apache software foundation · apache mina sshdSep 30, 2026
CVE-2024-11302
32Monitor
Missing check_access in lollms_binding_infos in parisneo/lollms
HighCVSS 8.0No exploitEPSS 0%
parisneo · parisneo/lollmsMar 20, 2025
CVE-2026-89068
32Monitor
MOVEit Transfer Authentication bypass in LDAP sign-on
HighCVSS 8.1No exploit
- Pre-auth
- Auth bypass
progress · moveit transferToday
CVE-2024-12136
31Monitor
Improper Access Control in Elfatek Elektronics' ANKA JPD-00028
HighCVSS 7.8No exploitEPSS 0%
- Auth bypass
elfatek · anka jpd00028 firmwareMar 19, 2025
CVE-2026-55957
30Monitor
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
HighCVSS 7.3Proof of conceptEPSS 3%
- Pre-auth
- Auth bypass
apache · tomcatJun 29, 2026
CVE-2022-2821
30Monitor
Missing Critical Step in Authentication in namelessmc/nameless
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
namelessmc · namelessAug 15, 2022
CVE-2024-20153
30Monitor
In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linuxfoundation · yoctoJan 6, 2025

All vulnerability classes