CWE-551 · 12 records

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

CVEs in this class

12 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2023-23924Proof of concept	URI validation failure on SVG parsing in Dompdfdompdf project · dompdf · CWE-551 pre-auth RCE	Critical9.8	—	3.5%	Jan 31, 2023
37Monitor	CVE-2016-20030No exploit	ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActionzkteco inc. · zkteco zkbiosecurity · CWE-551 Pre-auth	Critical9.3	—	0.5%	Mar 16, 2026
34Monitor	CVE-2021-32777No exploit	Incorrect concatenation of multiple value request headers in ext-authz extensionenvoyproxy · envoy · CWE-551 Pre-auth	High8.3	—	3.3%	Aug 24, 2021
33Monitor	CVE-2021-32779No exploit	Incorrectly handling of URI '#fragment' element as part of the path elementenvoyproxy · envoy · CWE-551 Pre-auth	High8.3	—	0.9%	Aug 24, 2021
32Monitor	CVE-2026-16102No exploit	Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappersredhat · build of keycloak · CWE-551	High8.1	—	0.4%	Aug 5, 2026
32Monitor	CVE-2026-15573No exploit	Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherredhat · build of keycloak · CWE-551	High8.1	—	0.4%	Aug 5, 2026
32Monitor	CVE-2026-4636No exploit	Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.redhat · build of keycloak · CWE-551	High8.1	—	0.4%	Apr 2, 2026
30Monitor	CVE-2026-87743No exploit	Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityred hat · exploit intelligence · CWE-551 Pre-auth	High7.5	—	0.5%	Sep 18, 2026
30Monitor	CVE-2026-89060No exploit	Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration referencesred hat · red hat advanced cluster management for kubernetes 2.13 · CWE-551	High7.7	—	0.4%	Sep 11, 2026
30Monitor	CVE-2026-57920No exploit	Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} enpeplink · intcontrol 2 · CWE-551	High7.7	—	0.3%	Jun 26, 2026
30Monitor	CVE-2026-106579No exploit	ImageMagick: Policy Bypass when using coder as the domain.imagemagick · imagemagick · CWE-551 Pre-auth	High7.5	—	0.3%	Oct 7, 2026
21Monitor	CVE-2026-0707No exploit	Keycloak: keycloak authorization header parsing leading to potential security control bypassred hat · red hat build of keycloak 26.4 · CWE-551 Pre-auth	Medium5.3	—	0.4%	Jan 8, 2026

CVE-2023-23924
40Plan
URI validation failure on SVG parsing in Dompdf
CriticalCVSS 9.8Proof of conceptEPSS 3%
- pre-auth RCE
dompdf project · dompdfJan 31, 2023
CVE-2016-20030
37Monitor
ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
zkteco inc. · zkteco zkbiosecurityMar 16, 2026
CVE-2021-32777
34Monitor
Incorrect concatenation of multiple value request headers in ext-authz extension
HighCVSS 8.3No exploitEPSS 3%
- Pre-auth
envoyproxy · envoyAug 24, 2021
CVE-2021-32779
33Monitor
Incorrectly handling of URI '#fragment' element as part of the path element
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
envoyproxy · envoyAug 24, 2021
CVE-2026-16102
32Monitor
Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
HighCVSS 8.1No exploitEPSS 0%
redhat · build of keycloakAug 5, 2026
CVE-2026-15573
32Monitor
Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
HighCVSS 8.1No exploitEPSS 0%
redhat · build of keycloakAug 5, 2026
CVE-2026-4636
32Monitor
Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.
HighCVSS 8.1No exploitEPSS 0%
redhat · build of keycloakApr 2, 2026
CVE-2026-87743
30Monitor
Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
red hat · exploit intelligenceSep 18, 2026
CVE-2026-89060
30Monitor
Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
HighCVSS 7.7No exploitEPSS 0%
red hat · red hat advanced cluster management for kubernetes 2.13Sep 11, 2026
CVE-2026-57920
30Monitor
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} en
HighCVSS 7.7No exploitEPSS 0%
peplink · intcontrol 2Jun 26, 2026
CVE-2026-106579
30Monitor
ImageMagick: Policy Bypass when using coder as the domain.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
imagemagick · imagemagickOct 7, 2026
CVE-2026-0707
21Monitor
Keycloak: keycloak authorization header parsing leading to potential security control bypass
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
red hat · red hat build of keycloak 26.4Jan 8, 2026

All vulnerability classes