CWE-287 · 4.927 kayıt
Hatalı kimlik doğrulama
Neden olur?
Kimlik doğrulama tek bir merkezden değil, yol yol ekleniyor. Sonradan eklenen bir yol ortak ara katmanı atladığında, oturum kontrolü o yol için hiç çalışmaz.
Nasıl önlenir?
- 01Kimlik doğrulamayı yönlendirici düzeyinde, tek bir ara katmanda zorunlu kılın.
- 02Varsayılanı “kapalı” yapın: açık uç noktalar bir izin listesinde tanımlansın.
- 03Testlerde her yönetim yolunu oturumsuz çağırıp 401 döndüğünü doğrulayın.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
app.use("/admin", requireSession, adminRouter);
// Sonradan eklenen yol, ara katmanı atlıyor
app.post("/admin-api/config", updateConfig);Düzeltilmiş
const admin = express.Router();
admin.use(requireSession, requireRole("admin"));
admin.post("/config", updateConfig);
app.use("/admin", admin);Kodunuzda bu kalıp var mı?
Web ve API sızma testi kapsamında bu sınıfı özellikle arıyoruz. Bulgular satır numarasıyla teslim edilir.
Bu sınıftaki CVE’ler
4.933 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
99Hemen | CVE-2023-35082Silahlaştırılmış | An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resouivanti · endpoint manager mobile · CWE-287 | Kritik9,8 | KEV | %99,9 | 15 Ağu 2023 |
99Hemen | CVE-2024-7593Silahlaştırılmış | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated aivanti · virtual traffic manager · CWE-287 | Kritik9,8 | KEV | %99,9 | 13 Ağu 2024 |
99Hemen | CVE-2023-35078Silahlaştırılmış | An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appliivanti · endpoint manager mobile · CWE-287 | Kritik9,8 | KEV | %99,9 | 25 Tem 2023 |
99Hemen | CVE-2017-7921Silahlaştırılmış | An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I hikvision · ds-2cd2032-i firmware · CWE-287 | Kritik9,8 | KEV | %99,9 | 5 May 2017 |
99Hemen | CVE-2021-33044Silahlaştırılmış | The identity authentication bypass vulnerability found in some Dahua products during the login process.dahuasecurity · ipc-hum7xxx firmware · CWE-287 | Kritik9,8 | KEV | %99,9 | 15 Eyl 2021 |
99Hemen | CVE-2022-40684Silahlaştırılmış | An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.fortinet · fortiproxy · CWE-287 | Kritik9,8 | KEV | %99,9 | 18 Eki 2022 |
99Hemen | CVE-2025-61882Silahlaştırılmış | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).oracle · concurrent processing · CWE-287 | Kritik9,8 | KEV | %99,7 | 5 Eki 2025 |
99Hemen | CVE-2021-33045Silahlaştırılmış | The identity authentication bypass vulnerability found in some Dahua products during the login process.dahuasecurity · ipc-hum7xxx firmware · CWE-287 | Kritik9,8 | KEV | %99,5 | 15 Eyl 2021 |
99Hemen | CVE-2021-32030Silahlaştırılmış | The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatioasus · lyra mini firmware · CWE-287 | Kritik9,8 | KEV | %99,3 | 6 May 2021 |
98Hemen | CVE-2024-53704Silahlaştırılmış | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.sonicwall · sonicos · CWE-287 | Kritik9,8 | KEV | %95,3 | 9 Oca 2025 |
97Hemen | CVE-2013-0625Silahlaştırılmış | Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exeadobe · coldfusion · CWE-287 | Kritik9,8 | KEV | %93,7 | 8 Oca 2013 |
97Hemen | CVE-2018-10561Silahlaştırılmış | An issue was discovered on Dasan GPON home routers.dasannetworks · gpon router firmware · CWE-287 | Kritik9,8 | KEV | %92,8 | 3 May 2018 |
97Hemen | CVE-2026-20182Silahlaştırılmış | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilitycisco · catalyst sd-wan manager · CWE-287 | Kritik10,0 | KEV | %91,0 | 14 May 2026 |
96Hemen | CVE-2026-20127Silahlaştırılmış | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilitycisco · catalyst sd-wan manager · CWE-287 | Kritik10,0 | KEV | %87,6 | 25 Şub 2026 |
95Hemen | CVE-2020-0688Silahlaştırılmış | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akmicrosoft · exchange server · CWE-287 | Yüksek8,8 | KEV | %99,9 | 11 Şub 2020 |
94Hemen | CVE-2015-1187Silahlaştırılmış | The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ctrendnet · tew-731br firmware · CWE-287 | Kritik9,8 | KEV | %82,6 | 21 Eyl 2017 |
93Hemen | CVE-2021-32648Silahlaştırılmış | Account Takeover in Octobercmsoctobercms · october · CWE-287 | Kritik9,1 | KEV | %91,2 | 26 Ağu 2021 |
93Hemen | CVE-2026-50751Silahlaştırılmış | User Authentication Bypass in VPN Remote Access and Mobile Accesscheckpoint · gaia os · CWE-287 | Kritik9,3 | KEV | %85,3 | 8 Haz 2026 |
92Hemen | CVE-2023-46805Silahlaştırılmış | An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to accivanti · connect secure · CWE-287 | Yüksek8,2 | KEV | %99,9 | 12 Oca 2024 |
90Hemen | CVE-2020-4427Silahlaştırılmış | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configibm · data risk manager · CWE-287 | Kritik9,8 | KEV | %70,0 | 7 May 2020 |
89Hemen | CVE-2021-39226Silahlaştırılmış | Snapshot authentication bypass in grafanagrafana · grafana · CWE-287 | Yüksek7,3 | KEV | %99,9 | 5 Eki 2021 |
89Hemen | CVE-2023-28461Silahlaştırılmış | Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution.arraynetworks · arrayos ag · CWE-287 | Kritik9,8 | KEV | %68,0 | 15 Mar 2023 |
87Hemen | CVE-2015-7755Silahlaştırılmış | Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 beforejuniper · screenos · CWE-287 | Kritik9,8 | KEV | %61,4 | 19 Ara 2015 |
86Hemen | CVE-2025-49706Silahlaştırılmış | Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint enterprise server · CWE-287 | Orta6,5 | KEV | %99,8 | 8 Tem 2025 |
85Hemen | CVE-2019-19006Silahlaştırılmış | Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.sangoma · freepbx · CWE-287 | Kritik9,8 | KEV | %54,9 | 21 Kas 2019 |
- CVE-2023-3508299Hemen
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resou
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99ivanti · endpoint manager mobile15 Ağu 2023
- CVE-2024-759399Hemen
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated a
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99ivanti · virtual traffic manager13 Ağu 2024
- CVE-2023-3507899Hemen
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appli
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99ivanti · endpoint manager mobile25 Tem 2023
- CVE-2017-792199Hemen
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99hikvision · ds-2cd2032-i firmware5 May 2017
- CVE-2021-3304499Hemen
The identity authentication bypass vulnerability found in some Dahua products during the login process.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99dahuasecurity · ipc-hum7xxx firmware15 Eyl 2021
- CVE-2022-4068499Hemen
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99fortinet · fortiproxy18 Eki 2022
- CVE-2025-6188299Hemen
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99oracle · concurrent processing5 Eki 2025
- CVE-2021-3304599Hemen
The identity authentication bypass vulnerability found in some Dahua products during the login process.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99dahuasecurity · ipc-hum7xxx firmware15 Eyl 2021
- CVE-2021-3203099Hemen
The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatio
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99asus · lyra mini firmware6 May 2021
- CVE-2024-5370498Hemen
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95sonicwall · sonicos9 Oca 2025
- CVE-2013-062597Hemen
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly exe
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93adobe · coldfusion8 Oca 2013
- CVE-2018-1056197Hemen
An issue was discovered on Dasan GPON home routers.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %92dasannetworks · gpon router firmware3 May 2018
- CVE-2026-2018297Hemen
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %91cisco · catalyst sd-wan manager14 May 2026
- CVE-2026-2012796Hemen
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %87cisco · catalyst sd-wan manager25 Şub 2026
- CVE-2020-068895Hemen
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, ak
YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99microsoft · exchange server11 Şub 2020
- CVE-2015-118794Hemen
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.c
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %82trendnet · tew-731br firmware21 Eyl 2017
- CVE-2021-3264893Hemen
Account Takeover in Octobercms
KritikCVSS 9,1KEVSilahlaştırılmışEPSS %91octobercms · october26 Ağu 2021
- CVE-2026-5075193Hemen
User Authentication Bypass in VPN Remote Access and Mobile Access
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %85checkpoint · gaia os8 Haz 2026
- CVE-2023-4680592Hemen
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc
YüksekCVSS 8,2KEVSilahlaştırılmışEPSS %99ivanti · connect secure12 Oca 2024
- CVE-2020-442790Hemen
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when config
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %70ibm · data risk manager7 May 2020
- CVE-2021-3922689Hemen
Snapshot authentication bypass in grafana
YüksekCVSS 7,3KEVSilahlaştırılmışEPSS %99grafana · grafana5 Eki 2021
- CVE-2023-2846189Hemen
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %68arraynetworks · arrayos ag15 Mar 2023
- CVE-2015-775587Hemen
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %61juniper · screenos19 Ara 2015
- CVE-2025-4970686Hemen
Microsoft SharePoint Server Spoofing Vulnerability
OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %99microsoft · sharepoint enterprise server8 Tem 2025
- CVE-2019-1900685Hemen
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %54sangoma · freepbx21 Kas 2019