CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
304 vulnerabilities reference this CWE, most recent first.
GHSA-CXQ4-8FF4-35JM
Vulnerability from github – Published: 2023-12-30 21:30 – Updated: 2024-10-10 18:31Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0.
{
"affected": [],
"aliases": [
"CVE-2023-6998"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-30T19:15:08Z",
"severity": "HIGH"
},
"details": "Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0.\n\n",
"id": "GHSA-cxq4-8ff4-35jm",
"modified": "2024-10-10T18:31:07Z",
"published": "2023-12-30T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6998"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2023/12/CVE-2023-6998"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2023/12/CVE-2023-6998"
},
{
"type": "WEB",
"url": "https://ewelink.cc/app"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F24P-XRCJ-VXHH
Vulnerability from github – Published: 2024-03-27 15:30 – Updated: 2026-05-20 12:30Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass.This issue affects TeoBASE: through 20240327. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2023-6153"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T13:15:46Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass by Primary Weakness vulnerability in TeoSOFT Software TeoBASE allows Authentication Bypass.This issue affects TeoBASE: through 20240327.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-f24p-xrcj-vxhh",
"modified": "2026-05-20T12:30:35Z",
"published": "2024-03-27T15:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6153"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0238"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-0238"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FC7V-6H7H-M2W9
Vulnerability from github – Published: 2024-03-21 03:36 – Updated: 2026-06-03 18:33Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.This issue affects Octopod: before v1.
NOTE: The vendor was contacted and it was learned that the product is not supported.
{
"affected": [],
"aliases": [
"CVE-2024-1202"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T02:51:38Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.This issue affects Octopod: before v1.\u00a0\n\nNOTE:\u00a0The vendor was contacted and it was learned that the product is not supported.",
"id": "GHSA-fc7v-6h7h-m2w9",
"modified": "2026-06-03T18:33:04Z",
"published": "2024-03-21T03:36:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1202"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0174"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-0174"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FF32-CMVQ-X6C5
Vulnerability from github – Published: 2025-01-09 09:31 – Updated: 2025-01-09 15:31SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.
{
"affected": [],
"aliases": [
"CVE-2024-12802"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T09:15:06Z",
"severity": "CRITICAL"
},
"details": "SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.",
"id": "GHSA-ff32-cmvq-x6c5",
"modified": "2025-01-09T15:31:51Z",
"published": "2025-01-09T09:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12802"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FM3M-JRGM-5PPG
Vulnerability from github – Published: 2025-08-04 20:46 – Updated: 2025-08-06 14:12Summary
- When an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in.
- In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access.
Details
In Go, r.URL.Path retrieves the part of the URL that comes after the port and before the query parameters or anchor symbols. For example, in the URL http://localhost:8080/api/ws/ssh?id=1, the retrieved path would be /api/ws/ssh.
However, if the request is made to http://localhost:8080//api/ws/ssh?id=1, the parsed r.URL.Path would be //api/ws/ssh.
RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, The route path inside the chi router will be cleaned to /api/ws/ssh, but this middleware does not process r.URL.Path, so the path is still //api/ws/ssh.
In the must_login middleware, RatPanel uses r.URL.Path to match the hard-coded prefix whitelist, because /api/ws does not match //api/ws. The must_login middleware will allow the request, but //api/ws has been cleaned to /api/ws in the chi router. This inconsistency leads to authentication bypass and accessing the dangerous interfaces such as /api/ws/exec and /api/ws/ssh.
But there are some limitations. Before exploiting this interface, the attacker must first identify the correct backend address of ratpanel to activate session legitimacy—specifically, to ensure sess.Put("verify_entrance", true). That said, accessing /api/ws only requires activating the session and does not require completing further authentication or login steps. Therefore, this is assessed to be a remotely exploitable command execution vulnerability with moderate severity.
PoC
I first carried session=......, accessed the backend login page normally(without completing the authentication process), activated the session, and then used the _wsdump.py script provided by the Python websocket-client library to complete the authentication and exploit the vulnerability.
Because of the authorization code
// internal/http/middleware/must_login.go
if slices.Contains(whiteList, r.URL.Path) || !strings.HasPrefix(r.URL.Path, "/api") {
next.ServeHTTP(w, r)
return
}
This vulnerability affects the authorization mechanism across all APIs, for example
This authentication vulnerability appears to affect versions v2.3.19 to v2.5.5.
Data packet
GET //api/...... HTTP/2
Host: IP:PORT
Cookie: session=XXXXXX
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json; charset=UTF-8
Connection: close
python _wsdump.py wss://ip:port//api/ws/exec --headers "Cookie: session=xxxxxx" -n
Impact
Users running Ratpanel versions v2.3.19 to v2.5.5—especially those who have exposed their admin panel login URL or use weak login URL paths—are vulnerable to unauthorized access. Additionally, versions v2.5.1 to v2.5.5 are susceptible to server and hosted machine takeover.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/tnborg/panel"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.19"
},
{
"fixed": "2.5.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/tnborg/panel"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-20241111062800-91ecd04c2700"
},
{
"fixed": "0.0.0-20250707071915-4985eb2e1f38"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53534"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-305",
"CWE-436"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-04T20:46:32Z",
"nvd_published_at": "2025-08-05T21:15:38Z",
"severity": "HIGH"
},
"details": "### Summary\n\n* When an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel **without logging in**.\n* In addition to this **remote code execution (RCE) vulnerability**, the flawed code also leads to **unauthorized access**.\n\n### Details\n\nIn Go, `r.URL.Path` retrieves the part of the URL that comes after the port and before the query parameters or anchor symbols. For example, in the URL `http://localhost:8080/api/ws/ssh?id=1`, the retrieved path would be `/api/ws/ssh`.\n\nHowever, if the request is made to `http://localhost:8080//api/ws/ssh?id=1`, the parsed `r.URL.Path` would be `//api/ws/ssh`. \n\nRatPanel uses the `CleanPath` middleware provided by `github.com/go-chi/chi` package to clean URLs, The route path inside the chi router will be cleaned to `/api/ws/ssh`, but this middleware does not process `r.URL.Path`, so the path is still `//api/ws/ssh`.\n\n\n\nIn the `must_login` middleware, RatPanel uses `r.URL.Path` to match the hard-coded prefix whitelist, because `/api/ws` does not match `//api/ws`. The `must_login` middleware will allow the request, but `//api/ws` has been cleaned to `/api/ws` in the chi router. This inconsistency leads to authentication bypass and accessing the dangerous interfaces such as `/api/ws/exec` and `/api/ws/ssh`.\n\n\n\nBut there are some limitations. Before exploiting this interface, the attacker must first identify the correct backend address of ratpanel to activate session legitimacy\u2014specifically, to ensure `sess.Put(\"verify_entrance\", true)`. That said, accessing `/api/ws` only requires activating the session and does not require completing further authentication or login steps. Therefore, this is assessed to be a remotely exploitable command execution vulnerability with moderate severity.\n\n\n### PoC\n\nI first carried `session=......`, accessed the backend login page normally` (without completing the authentication process)`, activated the session, and then used the [_wsdump.py](https://github.com/websocket-client/websocket-client/blob/master/websocket/_wsdump.py) script provided by the Python websocket-client library to complete the authentication and exploit the vulnerability.\n\n\n\n\n\nBecause of the authorization code\n\n```golang\n// internal/http/middleware/must_login.go\nif slices.Contains(whiteList, r.URL.Path) || !strings.HasPrefix(r.URL.Path, \"/api\") {\n next.ServeHTTP(w, r)\n return\n}\n```\n\nThis vulnerability affects the authorization mechanism across all APIs, for example\n\n\n\n\nThis authentication vulnerability appears to affect versions **v2.3.19 to v2.5.5**.\n\n---\n\nData packet\n\n```text\nGET //api/...... HTTP/2\nHost: IP:PORT\nCookie: session=XXXXXX\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nContent-Type: application/json; charset=UTF-8\nConnection: close\n\n\n```\n\n```cmd\npython _wsdump.py wss://ip:port//api/ws/exec --headers \"Cookie: session=xxxxxx\" -n\n```\n\n### Impact\n\nUsers running Ratpanel versions v2.3.19 to v2.5.5\u2014especially those who have exposed their admin panel login URL or use weak login URL paths\u2014are vulnerable to unauthorized access. Additionally, versions v2.5.1 to v2.5.5 are susceptible to server and hosted machine takeover.",
"id": "GHSA-fm3m-jrgm-5ppg",
"modified": "2025-08-06T14:12:21Z",
"published": "2025-08-04T20:46:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tnborg/panel/security/advisories/GHSA-fm3m-jrgm-5ppg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53534"
},
{
"type": "WEB",
"url": "https://github.com/tnborg/panel/commit/4985eb2e1f388ecd6faf331941c13cb97368ec1d"
},
{
"type": "WEB",
"url": "https://github.com/tnborg/panel/commit/91ecd04c270061429f9df5ec19cd6b96a9f595f2"
},
{
"type": "WEB",
"url": "https://github.com/tnborg/panel/commit/ed5c74c7534230ba685273504af4c1e1e3598ff1"
},
{
"type": "PACKAGE",
"url": "https://github.com/tnborg/panel"
},
{
"type": "WEB",
"url": "https://github.com/tnborg/panel/releases/tag/v2.5.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "RatPanel can perform remote command execution without authorization"
}
GHSA-FPM5-2WCJ-VFR7
Vulnerability from github – Published: 2024-11-06 15:57 – Updated: 2025-11-15 03:17Summary
Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user is generated in a weak manner, cannot be disabled, and has universal access.
Details
Until CodeChecker version 6.24.1 there was an auto-generated super-user account that could not be disabled. The attacker needs to know only the username of the root user.
This root user is unconditionally assigned superuser permissions.
Which means that if any user via any service logs in with the root user's username, they will unconditionally have superuser permissions on the CodeChecker instance.
The name of the user name can be found in root.user file in the CodeChecker configuration directory.
You can check if you are impacted by checking the existence of this user in the external authentication services (e.g. LDAP, PAM etc.).
Impact
This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.24.1"
},
"package": {
"ecosystem": "PyPI",
"name": "codechecker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.24.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-10082"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-06T15:57:57Z",
"nvd_published_at": "2024-11-06T15:15:11Z",
"severity": "CRITICAL"
},
"details": "### Summary\nAuthentication method confusion allows logging in as the built-in root user from an external service. The built-in root user is generated in a weak manner, cannot be disabled, and has universal access. \n\n### Details\nUntil CodeChecker version 6.24.1 there was an auto-generated super-user account that could not be disabled.\nThe attacker needs to know only the username of the root user.\n\nThis root user is unconditionally assigned superuser permissions.\n\nWhich means that if any user via any service logs in with the root user\u0027s username, they will unconditionally have superuser permissions on the CodeChecker instance.\n\nThe name of the user name can be found in `root.user` file in the CodeChecker configuration directory.\nYou can check if you are impacted by checking the existence of this user in the external authentication services (e.g. LDAP, PAM etc.).\n\n### Impact\nThis vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface.\nThe attacker needs to acquire the username of the root user to be successful.",
"id": "GHSA-fpm5-2wcj-vfr7",
"modified": "2025-11-15T03:17:21Z",
"published": "2024-11-06T15:57:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Ericsson/codechecker/security/advisories/GHSA-fpm5-2wcj-vfr7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10082"
},
{
"type": "WEB",
"url": "https://github.com/Ericsson/codechecker/commit/866f3796d01f3158c49b87ccae3e09c0807c1c7b"
},
{
"type": "PACKAGE",
"url": "https://github.com/Ericsson/codechecker"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2024-183.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service"
}
GHSA-FR2G-9HJM-WR23
Vulnerability from github – Published: 2023-10-19 16:13 – Updated: 2023-10-31 22:24Background
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.
NATS users exist within accounts, and once using accounts, the old authorization block is not applicable.
Problem Description
Without any authorization rules in the nats-server, users can connect without authentication.
Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an "authorization" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, "$G". Users inside accounts go into the newer "accounts" block.
If an "accounts" block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account "$SYS", the nats-server would create an implicit user in "$G" and set it as the no_auth_user account, enabling the same "without authentication" logic as without any rules.
This preserved the ability to connect simply, and then add one authenticated login for system access.
But with an "authorization" block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.
The blind-spot on our part came from encouraging and documenting a switch to using only "accounts", instead of "authorization".
In the fixed versions, using an "authorization" block will inhibit the implicit creation of a "$G" user and setting it as the no_auth_user target. In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.
Affected versions
NATS Server: * 2.2.0 up to and including 2.9.22 and 2.10.1 * Fixed with nats-io/nats-server: 2.10.2 and backported to 2.9.23
Workarounds
In the "accounts" block, define a second non-system account, leave it empty.
accounts {
SYS: {
users: [
{ user: sysuser, password: makemeasandwich }
]
}
DUMMY: {} # for security, before 2.10.2
}
system_account: SYS
Solution
Any one of these:
- Upgrade the NATS server to at least 2.10.2 (or 2.9.23)
- Or define a dummy account
- Or complete the migration of authorization entries to be inside a named account in the "accounts" block
Credits
Problem reported by Alex Herrington.
Addressed publicly in a GitHub Discussion prior to this advisory.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/nats-io/nats-server/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.9.23"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/nats-io/nats-server/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.10.0"
},
{
"fixed": "2.10.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-47090"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-19T16:13:03Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Background\n\nNATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.\n\nNATS users exist within accounts, and once using accounts, the old authorization block is not applicable.\n\n\n## Problem Description\n\nWithout any authorization rules in the nats-server, users can connect without authentication.\n\nBefore nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an \"authorization\" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using the authorization block, whose syntax predates this, those users will be placed into the implicit global account, \"$G\". Users inside accounts go into the newer \"accounts\" block.\n\nIf an \"accounts\" block is defined, in simple deployment scenarios this is often used only to enable client access to the system account. When the only account added is the system account \"$SYS\", the nats-server would create an implicit user in \"$G\" and set it as the `no_auth_user` account, enabling the same \"without authentication\" logic as without any rules.\n\nThis preserved the ability to connect simply, and then add one authenticated login for system access.\n\nBut with an \"authorization\" block, this is wrong. Users exist in the global account, with login rules. And in simple testing, they might still connect fine without administrators seeing that authentication has been disabled.\n\nThe blind-spot on our part came from encouraging and documenting a switch to using only \"accounts\", instead of \"authorization\".\n\nIn the fixed versions, using an \"authorization\" block will inhibit the implicit creation of a \"$G\" user and setting it as the `no_auth_user` target. In unfixed versions, just creating a second account, with no users, will also inhibit this behavior.\n\n\n## Affected versions\n\nNATS Server:\n * 2.2.0 up to and including 2.9.22 and 2.10.1\n * Fixed with nats-io/nats-server: 2.10.2 and backported to 2.9.23\n\n\n## Workarounds\n\nIn the \"accounts\" block, define a second non-system account, leave it empty.\n\n accounts {\n SYS: {\n users: [\n { user: sysuser, password: makemeasandwich }\n ]\n }\n DUMMY: {} # for security, before 2.10.2\n }\n system_account: SYS\n\n\n## Solution\n\nAny one of these:\n\n 1. Upgrade the NATS server to at least 2.10.2 (or 2.9.23)\n 2. Or define a dummy account\n 3. Or complete the migration of authorization entries to be inside a named account in the \"accounts\" block\n\n\n## Credits\n\nProblem reported by Alex Herrington. \nAddressed publicly in a GitHub Discussion prior to this advisory.",
"id": "GHSA-fr2g-9hjm-wr23",
"modified": "2023-10-31T22:24:58Z",
"published": "2023-10-19T16:13:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/pull/4605"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/commit/fa5b7afcb64e7e887e49afdd032358802b5c4478"
},
{
"type": "WEB",
"url": "https://advisories.nats.io/CVE/secnote-2023-01.txt"
},
{
"type": "PACKAGE",
"url": "https://github.com/nats-io/nats-server"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/discussions/4535"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/releases/tag/v2.10.2"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/releases/tag/v2.9.23"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "NATS.io: Adding accounts for just the system account adds auth bypass"
}
GHSA-FV4Q-WM8C-WJG4
Vulnerability from github – Published: 2022-05-24 17:02 – Updated: 2023-09-26 19:52A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-parent"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-14909"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-18T22:03:15Z",
"nvd_published_at": "2019-12-04T15:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.",
"id": "GHSA-fv4q-wm8c-wjg4",
"modified": "2023-09-26T19:52:42Z",
"published": "2022-05-24T17:02:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14909"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2019-14909"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Authentication Error"
}
GHSA-G28R-W65R-H89M
Vulnerability from github – Published: 2022-03-19 00:00 – Updated: 2025-11-03 21:30OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
{
"affected": [],
"aliases": [
"CVE-2022-0547"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-18T18:15:00Z",
"severity": "CRITICAL"
},
"details": "OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.",
"id": "GHSA-g28r-w65r-h89m",
"modified": "2025-11-03T21:30:38Z",
"published": "2022-03-19T00:00:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0547"
},
{
"type": "WEB",
"url": "https://community.openvpn.net/openvpn/wiki/CVE-2022-0547"
},
{
"type": "WEB",
"url": "https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF"
},
{
"type": "WEB",
"url": "https://openvpn.net/community-downloads"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G394-QPX6-X7RR
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32In langgenius/dify v0.10.1, the /forgot-password/resets endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.
{
"affected": [],
"aliases": [
"CVE-2024-12776"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:30Z",
"severity": "HIGH"
},
"details": "In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.",
"id": "GHSA-g394-qpx6-x7rr",
"modified": "2025-03-20T12:32:43Z",
"published": "2025-03-20T12:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12776"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/00a8b403-7da5-431e-afa3-40339cf734bf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.