CWE-308 · 16 records

Use of Single-factor Authentication

CVEs in this class

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-58240No exploit	Missing Authentication check in SAP NetWeaver (Message Server)sap_se · sap netweaver (message server) · CWE-308 Pre-auth Auth bypass	Critical9.8	—	0.5%	Sep 7, 2026
36Monitor	CVE-2026-15616No exploit	Local MFA not enforced during SSO sign-inlogto · logto · CWE-308 Pre-auth	Critical9.1	—	0.5%	Jul 23, 2026
34Monitor	CVE-2026-67611No exploit	OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configurationopen-emr · openemr · CWE-308 Auth bypass	High8.6	—	0.8%	Aug 3, 2026
32Monitor	CVE-2025-42959No exploit	Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476sap_se · sap netweaver abap server and abap platform · CWE-308 Pre-auth Auth bypass	High8.1	—	0.6%	Jul 7, 2025
32Monitor	CVE-2026-45749No exploit	Termix's TOTP two-factor authentication can be disabled or bypassed using only the account passwordtermix · termix · CWE-308	High8.1	—	0.5%	Jun 5, 2026
30Monitor	CVE-2024-47652No exploit	Insecure Authentication Vulnerabilityshilpisoft · client dashboard · CWE-308	High7.6	—	0.4%	Oct 4, 2024
28Monitor	CVE-2023-49075No exploit	Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewallspimcore · admin classic bundle · CWE-308	High7.2	—	1.4%	Nov 28, 2023
28Monitor	CVE-2026-85590No exploit	phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disablethorsten · phpmyfaq · CWE-308 Auth bypass CSRF	High7.1	—	0.5%	Sep 4, 2026
27Monitor	CVE-2026-56022No exploit	Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of adwebmin · webmin · CWE-308 Pre-auth	Medium6.9	—	0.6%	Jun 18, 2026
26Monitor	CVE-2023-25681No exploit	IBM Spectrum Virtualize security bypassibm · spectrum virtualize · CWE-308	Medium6.5	—	0.6%	Mar 5, 2024
26Monitor	CVE-2023-34228No exploit	In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actionsjetbrains · teamcity · CWE-308	Medium6.5	—	0.4%	May 31, 2023
23Monitor	CVE-2024-27928No exploit	Vantage6: 2FA can be circumvented with hacked email accessvantage6 · vantage6 · CWE-308	Medium5.9	—	0.3%	Jun 17, 2026
21Monitor	CVE-2023-50934No exploit	IBM PowerSC improper authenticationibm · powersc · CWE-308 Pre-auth Auth bypass	Medium5.3	—	0.4%	Feb 1, 2024
21Monitor	CVE-2026-79763No exploit	Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)termix-ssh · termix · CWE-308	Medium5.3	—	0.3%	Sep 24, 2026
17Monitor	CVE-2024-50618No exploit	A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypcipplanner · cipace · CWE-308	Medium4.3	—	0.3%	Feb 11, 2026
10Monitor	CVE-2026-33550No exploit	SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommalinto · sogo · CWE-308	Low2.6	—	0.2%	Mar 21, 2026

CVE-2026-58240
39Monitor
Missing Authentication check in SAP NetWeaver (Message Server)
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
sap_se · sap netweaver (message server)Sep 7, 2026
CVE-2026-15616
36Monitor
Local MFA not enforced during SSO sign-in
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
logto · logtoJul 23, 2026
CVE-2026-67611
34Monitor
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
HighCVSS 8.6No exploitEPSS 1%
- Auth bypass
open-emr · openemrAug 3, 2026
CVE-2025-42959
32Monitor
Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
- Auth bypass
sap_se · sap netweaver abap server and abap platformJul 7, 2025
CVE-2026-45749
32Monitor
Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
HighCVSS 8.1No exploitEPSS 0%
termix · termixJun 5, 2026
CVE-2024-47652
30Monitor
Insecure Authentication Vulnerability
HighCVSS 7.6No exploitEPSS 0%
shilpisoft · client dashboardOct 4, 2024
CVE-2023-49075
28Monitor
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
HighCVSS 7.2No exploitEPSS 1%
pimcore · admin classic bundleNov 28, 2023
CVE-2026-85590
28Monitor
phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
HighCVSS 7.1No exploitEPSS 1%
- Auth bypass
- CSRF
thorsten · phpmyfaqSep 4, 2026
CVE-2026-56022
27Monitor
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of ad
MediumCVSS 6.9No exploitEPSS 1%
- Pre-auth
webmin · webminJun 18, 2026
CVE-2023-25681
26Monitor
IBM Spectrum Virtualize security bypass
MediumCVSS 6.5No exploitEPSS 1%
ibm · spectrum virtualizeMar 5, 2024
CVE-2023-34228
26Monitor
In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions
MediumCVSS 6.5No exploitEPSS 0%
jetbrains · teamcityMay 31, 2023
CVE-2024-27928
23Monitor
Vantage6: 2FA can be circumvented with hacked email access
MediumCVSS 5.9No exploitEPSS 0%
vantage6 · vantage6Jun 17, 2026
CVE-2023-50934
21Monitor
IBM PowerSC improper authentication
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · powerscFeb 1, 2024
CVE-2026-79763
21Monitor
Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)
MediumCVSS 5.3No exploitEPSS 0%
termix-ssh · termixSep 24, 2026
CVE-2024-50618
17Monitor
A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to byp
MediumCVSS 4.3No exploitEPSS 0%
cipplanner · cipaceFeb 11, 2026
CVE-2026-33550
10Monitor
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recomm
LowCVSS 2.6No exploitEPSS 0%
alinto · sogoMar 21, 2026

All vulnerability classes