CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
6650 vulnerabilities reference this CWE, most recent first.
GHSA-WPMR-8H3Q-FWJ7
Vulnerability from github – Published: 2026-09-10 21:23 – Updated: 2026-09-10 21:23Summary
On SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the database returns first, which can be an administrator. The same defect affects SCIM external-ID resolution. PostgreSQL deployments are not affected, because they take a separate and correct code path.
Preconditions
- The database is SQLite. This is the default backend. PostgreSQL deployments are not affected at all.
- OAuth or OIDC sign-in is configured, or SCIM provisioning is enabled. Both are off by default.
- For an attacker to steer the match deliberately, they must control the value of the claim Open WebUI uses as the subject. That value is normally assigned by the identity provider and is not attacker-controlled: the shipped GitHub and Feishu configurations use provider-assigned numeric identifiers, and a standard OIDC
subis provider-assigned. The deliberate case therefore requires an operator to have pointedOAUTH_SUB_CLAIMat a claim the end user can set at the identity provider, such as a username or email claim, or an identity provider that lets a user choose their own subject value. - No attacker and no misconfiguration are needed for the accidental case. A legitimate subject value that happens to contain an underscore matches other accounts as well, and which account is returned depends on database row order.
- For the SCIM path, the caller must already hold the SCIM bearer token, which is a privileged credential.
Impact
A sign-in can be bound to an account other than the one the identity provider authenticated. Where the operator has made the subject claim user-settable, an attacker who registers at that provider can choose a value that matches an existing account and receive a session for it, including an administrator account, which is a full compromise of the instance. Where the subject claim is provider-assigned, the deliberate attack is not available, and what remains is a correctness failure in which an ordinary subject value containing an underscore can resolve to the wrong account and hand one user another user's session non-deterministically.
The defect is in the identity match itself, so it is not mitigated by any downstream permission check: by the time a session is issued the wrong account has already been selected. It does not allow account creation, and it does not affect password sign-in, PostgreSQL deployments, or any deployment with OAuth, OIDC and SCIM all disabled.
Fix
Fixed in 0.11.1 by https://github.com/open-webui/open-webui/pull/28624. The two identity lookups now compare the nested JSON value directly through SQLAlchemy's JSON subscript operator, which emits an exact match on both supported databases, instead of going through the column-level contains() operator that degraded to a substring comparison on SQLite. The hand-written per-dialect branching is removed, since the operator already handles both backends.
Upgrading fully resolves it and no configuration change is required. Existing stored identities are unaffected, as the stored format does not change.
Root cause
backend/open_webui/models/users.py—get_user_by_oauth_sub, resolves an OAuth or OIDC identity to a local account.backend/open_webui/models/users.py—get_user_by_scim_external_id, the same pattern for SCIM.- Reached from the OAuth callback handler and the OAuth token-exchange handler, and from the SCIM user routes.
- Affects builds running on SQLite, which is the default database.
The oauth and scim columns are declared with SQLAlchemy's generic JSON type. That type does not implement a containment comparator, so a contains() call against it falls back to the generic string operator and compiles to a LIKE with the operand wrapped in % on both sides. The intent was a JSON containment test; what was emitted was a substring test against the serialized JSON, in which % and _ carry their usual LIKE meaning. The PostgreSQL branch was written separately against JSONB with an equality comparison and is correct, which is why the defect is confined to the default backend and why it survived review: the two branches look symmetrical and only one of them does what it appears to do.
Proof of concept
Against a SQLite instance with an OIDC provider configured, two accounts exist: an administrator whose stored subject is admin_sub_9999, and an ordinary user whose stored subject is bob_sub_1234. Both rows were seeded directly rather than created through a live provider sign-in; the lookup under test was then called as the application calls it.
Resolving the subject value % returns the administrator account. Resolving admin_sub_% likewise returns the administrator account. Resolving the correct full values returns the correct accounts, and resolving an unknown value returns nothing, so the failure is visible only when the supplied value contains a wildcard character. A subsequent check with an ordinary subject value containing an underscore showed it matching more than one account, with the returned account determined by row order.
Credits
Reported by @Classic298.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0.6.41"
},
{
"fixed": "0.11.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-87016"
],
"database_specific": {
"cwe_ids": [
"CWE-155",
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-10T21:23:25Z",
"nvd_published_at": "2026-09-09T22:18:46Z",
"severity": "HIGH"
},
"details": "## Summary\n\nOn SQLite deployments, the lookup that maps an external identity to a local account does a substring match instead of an exact match. A subject value containing SQL wildcard characters therefore matches accounts the value was never issued for, and the sign-in binds to whichever account the database returns first, which can be an administrator. The same defect affects SCIM external-ID resolution. PostgreSQL deployments are not affected, because they take a separate and correct code path.\n\n## Preconditions\n\n* The database is SQLite. This is the default backend. PostgreSQL deployments are not affected at all.\n* OAuth or OIDC sign-in is configured, or SCIM provisioning is enabled. Both are off by default.\n* For an attacker to steer the match deliberately, they must control the value of the claim Open WebUI uses as the subject. That value is normally assigned by the identity provider and is not attacker-controlled: the shipped GitHub and Feishu configurations use provider-assigned numeric identifiers, and a standard OIDC `sub` is provider-assigned. The deliberate case therefore requires an operator to have pointed `OAUTH_SUB_CLAIM` at a claim the end user can set at the identity provider, such as a username or email claim, or an identity provider that lets a user choose their own subject value.\n* No attacker and no misconfiguration are needed for the accidental case. A legitimate subject value that happens to contain an underscore matches other accounts as well, and which account is returned depends on database row order.\n* For the SCIM path, the caller must already hold the SCIM bearer token, which is a privileged credential.\n\n## Impact\n\nA sign-in can be bound to an account other than the one the identity provider authenticated. Where the operator has made the subject claim user-settable, an attacker who registers at that provider can choose a value that matches an existing account and receive a session for it, including an administrator account, which is a full compromise of the instance. Where the subject claim is provider-assigned, the deliberate attack is not available, and what remains is a correctness failure in which an ordinary subject value containing an underscore can resolve to the wrong account and hand one user another user\u0027s session non-deterministically.\n\nThe defect is in the identity match itself, so it is not mitigated by any downstream permission check: by the time a session is issued the wrong account has already been selected. It does not allow account creation, and it does not affect password sign-in, PostgreSQL deployments, or any deployment with OAuth, OIDC and SCIM all disabled.\n\n## Fix\n\nFixed in 0.11.1 by https://github.com/open-webui/open-webui/pull/28624. The two identity lookups now compare the nested JSON value directly through SQLAlchemy\u0027s JSON subscript operator, which emits an exact match on both supported databases, instead of going through the column-level `contains()` operator that degraded to a substring comparison on SQLite. The hand-written per-dialect branching is removed, since the operator already handles both backends.\n\nUpgrading fully resolves it and no configuration change is required. Existing stored identities are unaffected, as the stored format does not change.\n\n## Root cause\n\n* `backend/open_webui/models/users.py` \u2014 `get_user_by_oauth_sub`, resolves an OAuth or OIDC identity to a local account.\n* `backend/open_webui/models/users.py` \u2014 `get_user_by_scim_external_id`, the same pattern for SCIM.\n* Reached from the OAuth callback handler and the OAuth token-exchange handler, and from the SCIM user routes.\n* Affects builds running on SQLite, which is the default database.\n\nThe `oauth` and `scim` columns are declared with SQLAlchemy\u0027s generic `JSON` type. That type does not implement a containment comparator, so a `contains()` call against it falls back to the generic string operator and compiles to a `LIKE` with the operand wrapped in `%` on both sides. The intent was a JSON containment test; what was emitted was a substring test against the serialized JSON, in which `%` and `_` carry their usual `LIKE` meaning. The PostgreSQL branch was written separately against `JSONB` with an equality comparison and is correct, which is why the defect is confined to the default backend and why it survived review: the two branches look symmetrical and only one of them does what it appears to do.\n\n## Proof of concept\n\nAgainst a SQLite instance with an OIDC provider configured, two accounts exist: an administrator whose stored subject is `admin_sub_9999`, and an ordinary user whose stored subject is `bob_sub_1234`. Both rows were seeded directly rather than created through a live provider sign-in; the lookup under test was then called as the application calls it.\n\nResolving the subject value `%` returns the administrator account. Resolving `admin_sub_%` likewise returns the administrator account. Resolving the correct full values returns the correct accounts, and resolving an unknown value returns nothing, so the failure is visible only when the supplied value contains a wildcard character. A subsequent check with an ordinary subject value containing an underscore showed it matching more than one account, with the returned account determined by row order.\n\n## Credits\n\nReported by @Classic298.",
"id": "GHSA-wpmr-8h3q-fwj7",
"modified": "2026-09-10T21:23:25Z",
"published": "2026-09-10T21:23:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-wpmr-8h3q-fwj7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87016"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/pull/28624"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/commit/73c1f5806aeb6345dad5de8f5aa26d1f3d0bef80"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite"
}
GHSA-WPP8-FP59-G7VC
Vulnerability from github – Published: 2022-05-17 05:25 – Updated: 2022-05-17 05:25McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by capturing a session cookie and then modifying the response to a login attempt, related to a "Logout Failure" issue.
{
"affected": [],
"aliases": [
"CVE-2012-4581"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-08-22T10:42:00Z",
"severity": "MODERATE"
},
"details": "McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by capturing a session cookie and then modifying the response to a login attempt, related to a \"Logout Failure\" issue.",
"id": "GHSA-wpp8-fp59-g7vc",
"modified": "2022-05-17T05:25:10Z",
"published": "2022-05-17T05:25:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4581"
},
{
"type": "WEB",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10020"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WPPF-7C2C-MMM7
Vulnerability from github – Published: 2022-05-17 05:12 – Updated: 2022-05-17 05:12EMC Smarts Network Configuration Manager (NCM) before 9.2 does not require authentication for all Java RMI method calls, which allows remote attackers to execute arbitrary code via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2013-0935"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-03-28T15:55:00Z",
"severity": "HIGH"
},
"details": "EMC Smarts Network Configuration Manager (NCM) before 9.2 does not require authentication for all Java RMI method calls, which allows remote attackers to execute arbitrary code via unspecified vectors.",
"id": "GHSA-wppf-7c2c-mmm7",
"modified": "2022-05-17T05:12:24Z",
"published": "2022-05-17T05:12:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0935"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-03/0135.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WPRP-JM6R-6W3Q
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies.
{
"affected": [],
"aliases": [
"CVE-2020-19037"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-12T17:15:00Z",
"severity": "MODERATE"
},
"details": "Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies.",
"id": "GHSA-wprp-jm6r-6w3q",
"modified": "2022-05-24T19:07:28Z",
"published": "2022-05-24T19:07:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19037"
},
{
"type": "WEB",
"url": "https://github.com/halo-dev/halo/issues/135"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WPV9-PVP6-9MJQ
Vulnerability from github – Published: 2022-05-17 04:56 – Updated: 2025-04-11 04:08The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
{
"affected": [],
"aliases": [
"CVE-2013-1080"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-03-29T16:09:00Z",
"severity": "HIGH"
},
"details": "The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.",
"id": "GHSA-wpv9-pvp6-9mjq",
"modified": "2025-04-11T04:08:56Z",
"published": "2022-05-17T04:56:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1080"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/24938"
},
{
"type": "WEB",
"url": "http://www.novell.com/support/kb/doc.php?id=7011812"
},
{
"type": "WEB",
"url": "http://www.novell.com/support/kb/doc.php?id=7012027"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-13-049"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WPXJ-4MM5-PVQ8
Vulnerability from github – Published: 2022-11-11 19:00 – Updated: 2022-11-17 18:30Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information disclosure via network access.
{
"affected": [],
"aliases": [
"CVE-2022-26508"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-11T16:15:00Z",
"severity": "HIGH"
},
"details": "Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information disclosure via network access.",
"id": "GHSA-wpxj-4mm5-pvq8",
"modified": "2022-11-17T18:30:30Z",
"published": "2022-11-11T19:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26508"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00710.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WQ59-4Q6R-635R
Vulnerability from github – Published: 2023-12-19 23:37 – Updated: 2023-12-21 15:58Summary
A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key "not so secret".
The vulnerability can only be exploited on instances that have never been restarted.
Details
Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a jwt query parameter instead of the traditional password or token and salt (corresponding to resp. the p or t and s query parameters).
During the first initialization, navidrome generates a random key that is then used by the authentication module to validate JWTs before extracting the username from the sub claim. If for some reason the key cannot be retrieved by the initialization code, a hardcoded value is used instead: "not so secret".
A bug in the order of operations during navidrome startup results in the authentication module initializing before the module responsible for generating and persisting the random key. As a consequence, the authentication module falls back to using the hardcoded value, which remains in use until the instance gets restarted. Additionally, an error that was meant to be logged when the fallback value is used does not get logged due to another bug, preventing the operator from becoming aware of the issue.
The flaw allows the creation of a JWT with the sub claim set to any existing user on the server, signed with the key "not so secret", which can then be used to authenticate against the subsonic endpoint with the chosen user's privileges.
After navidrome is restarted, the random key generated during the previous startup is loaded and the flaw becomes inexploitable.
PoC
Generate a JWT token with the subject "admin", and key "not so secret" (e.g. online on: http://jwtbuilder.jamiekurtz.com; the other parameters can be left in, it doesn't seem that navidrome validates anything). In a shell, assign the token to the variable JWT (for the curl commands below).
$ podman run -d --name navidrome -p 127.0.0.1:4533:4533 -e ND_DEVAUTOCREATEADMINPASSWORD=password docker.io/deluan/navidrome:0.50.1
$ curl "http://localhost:4533/rest/ping.view?c=dummy&v=1&u=admin&jwt=$JWT"
<subsonic-response xmlns="http://subsonic.org/restapi" status="ok" version="1.16.1" type="navidrome" serverVersion="0.50.1 (f69c27d1)" openSubsonic="true"></subsonic-response>
The ND_DEVAUTOCREATEADMINPASSWORD parameter does not influence the bypass, it also works if the admin or extra users are created manually after starting navidrome.
Restarting navidrome prevents the bypass:
$ podman restart navidrome
$ curl "http://localhost:4533/rest/ping.view?c=dummy&v=1&u=admin&jwt=$JWT"
<subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="navidrome" serverVersion="0.50.1 (f69c27d1)" openSubsonic="true"><error code="40" message="Wrong username or password"></error></subsonic-response>
Impact
This authentication bypass vulnerability potentially affects all instances that don't protect the subsonic endpoint /rest/, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected).
The impact is limited by the fact that the flaw becomes inexploitable after a first restart, and the attacker needs to know the username of existing users on the instance.
For each known user, the attacker could mess with (create/delete/change) playlists, bookmarks, media annotations, shares (which are currently global) and radios. He is also able to get the user's email address (which is PII) with the getUser operation. And lastly he can use the media retrieval operations which could potentially affect the availability of the system.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.50.1"
},
"package": {
"ecosystem": "Go",
"name": "github.com/navidrome/navidrome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.50.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-51442"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-19T23:37:45Z",
"nvd_published_at": "2023-12-21T15:15:13Z",
"severity": "HIGH"
},
"details": "### Summary\n\nA security vulnerability has been identified in navidrome\u0027s subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key \"not so secret\".\n\nThe vulnerability can only be exploited on instances that have never been restarted.\n\n### Details\n\nNavidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters).\n\nDuring the first initialization, navidrome generates a random key that is then used by the authentication module to validate JWTs before extracting the username from the `sub` claim. If for some reason the key cannot be retrieved by the initialization code, a hardcoded value is used instead: \"not so secret\".\n\nA bug in the order of operations during navidrome startup results in the authentication module initializing before the module responsible for generating and persisting the random key. As a consequence, the authentication module falls back to using the hardcoded value, which remains in use until the instance gets restarted. Additionally, an error that was meant to be logged when the fallback value is used does not get logged due to another bug, preventing the operator from becoming aware of the issue.\n\nThe flaw allows the creation of a JWT with the `sub` claim set to any existing user on the server, signed with the key \"not so secret\", which can then be used to authenticate against the subsonic endpoint with the chosen user\u0027s privileges.\n\nAfter navidrome is restarted, the random key generated during the previous startup is loaded and the flaw becomes inexploitable.\n\n### PoC\n\nGenerate a JWT token with the subject \"admin\", and key \"not so secret\" (e.g. online on: http://jwtbuilder.jamiekurtz.com; the other parameters can be left in, it doesn\u0027t seem that navidrome validates anything). In a shell, assign the token to the variable `JWT` (for the curl commands below).\n\n```\n$ podman run -d --name navidrome -p 127.0.0.1:4533:4533 -e ND_DEVAUTOCREATEADMINPASSWORD=password docker.io/deluan/navidrome:0.50.1\n$ curl \"http://localhost:4533/rest/ping.view?c=dummy\u0026v=1\u0026u=admin\u0026jwt=$JWT\"\n\u003csubsonic-response xmlns=\"http://subsonic.org/restapi\" status=\"ok\" version=\"1.16.1\" type=\"navidrome\" serverVersion=\"0.50.1 (f69c27d1)\" openSubsonic=\"true\"\u003e\u003c/subsonic-response\u003e\n```\n\nThe `ND_DEVAUTOCREATEADMINPASSWORD` parameter does not influence the bypass, it also works if the admin or extra users are created manually after starting navidrome.\n\nRestarting navidrome prevents the bypass:\n\n```\n$ podman restart navidrome\n$ curl \"http://localhost:4533/rest/ping.view?c=dummy\u0026v=1\u0026u=admin\u0026jwt=$JWT\"\n\u003csubsonic-response xmlns=\"http://subsonic.org/restapi\" status=\"failed\" version=\"1.16.1\" type=\"navidrome\" serverVersion=\"0.50.1 (f69c27d1)\" openSubsonic=\"true\"\u003e\u003cerror code=\"40\" message=\"Wrong username or password\"\u003e\u003c/error\u003e\u003c/subsonic-response\u003e\n```\n\n### Impact\n\nThis authentication bypass vulnerability potentially affects all instances that don\u0027t protect the subsonic endpoint `/rest/`, which is expected to be most instances in a standard deployment, and most instances in the reverse proxy setup too (as the documentation mentions to leave that endpoint unprotected).\n\nThe impact is limited by the fact that the flaw becomes inexploitable after a first restart, and the attacker needs to know the username of existing users on the instance.\n\nFor each known user, the attacker could mess with (create/delete/change) playlists, bookmarks, media annotations, shares (which are currently global) and radios. He is also able to get the user\u0027s email address (which is PII) with the `getUser` operation. And lastly he can use the media retrieval operations which could potentially affect the availability of the system.",
"id": "GHSA-wq59-4q6r-635r",
"modified": "2023-12-21T15:58:09Z",
"published": "2023-12-19T23:37:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/navidrome/navidrome/security/advisories/GHSA-wq59-4q6r-635r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51442"
},
{
"type": "WEB",
"url": "https://github.com/navidrome/navidrome/commit/1132abb0135d1ecaebc41ed97a1e908a4ae02f7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/navidrome/navidrome"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Authentication bypass vulnerability in navidrome\u0027s subsonic endpoint"
}
GHSA-WQ5J-2JWC-3H38
Vulnerability from github – Published: 2024-01-09 03:30 – Updated: 2024-01-12 15:30Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.
{
"affected": [],
"aliases": [
"CVE-2023-51717"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-09T02:15:45Z",
"severity": "CRITICAL"
},
"details": "Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.",
"id": "GHSA-wq5j-2jwc-3h38",
"modified": "2024-01-12T15:30:25Z",
"published": "2024-01-09T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51717"
},
{
"type": "WEB",
"url": "https://dataiku.com"
},
{
"type": "WEB",
"url": "https://doc.dataiku.com/dss/latest/security/advisories/dsa-2023-010.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WQ9F-W2RJ-J5WC
Vulnerability from github – Published: 2022-10-19 12:00 – Updated: 2026-05-27 18:31Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2022-21618"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-18T21:15:00Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).",
"id": "GHSA-wq9f-w2rj-j5wc",
"modified": "2026-05-27T18:31:34Z",
"published": "2022-10-19T12:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21618"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37QDWJBGEPP65X43NXQTXQ7KASLUHON6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ARF4QF4N3X5GSFHXUBWARGLISGKJ33R"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QLQ7OD33W6LT3HWI7VYDFFJLV75Y73K"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXSBV3W6EP6B7XJ63Z2FPVBH6HAPGJ5T"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/37QDWJBGEPP65X43NXQTXQ7KASLUHON6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ARF4QF4N3X5GSFHXUBWARGLISGKJ33R"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QLQ7OD33W6LT3HWI7VYDFFJLV75Y73K"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXSBV3W6EP6B7XJ63Z2FPVBH6HAPGJ5T"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-25"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221028-0012"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WQFV-XX2R-H6V5
Vulnerability from github – Published: 2022-05-17 00:36 – Updated: 2022-05-17 00:36The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox "exec" command. As the process is running as "root" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.
{
"affected": [],
"aliases": [
"CVE-2017-7649"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-11T16:29:00Z",
"severity": "CRITICAL"
},
"details": "The network enabled distribution of Kura before 2.1.0 takes control over the device\u0027s firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox \"exec\" command. As the process is running as \"root\" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.",
"id": "GHSA-wqfv-xx2r-h6v5",
"modified": "2022-05-17T00:36:10Z",
"published": "2022-05-17T00:36:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7649"
},
{
"type": "WEB",
"url": "https://github.com/eclipse/kura/issues/956"
},
{
"type": "WEB",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=514681"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.