Common Weakness Enumeration
CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
281 vulnerabilities reference this CWE, most recent first.
GHSA-HG48-698Q-829J
Vulnerability from github – Published: 2026-03-03 21:31 – Updated: 2026-03-09 18:31
VLAI
Details
Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming configuration. and could even disable the ASCG application or disable use of BSL data collection on Brocade switches within the fabric.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-0869"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-03T20:16:45Z",
"severity": "HIGH"
},
"details": "Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support Link(BSL) and streaming configuration. and could even disable the ASCG application or disable use of BSL data collection on Brocade switches within the fabric.",
"id": "GHSA-hg48-698q-829j",
"modified": "2026-03-09T18:31:36Z",
"published": "2026-03-03T21:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0869"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/external/content/SecurityAdvisories/0/37121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HHJ7-6JP7-94J9
Vulnerability from github – Published: 2023-09-12 00:30 – Updated: 2023-09-12 00:30
VLAI
Details
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-4898"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-12T00:15:09Z",
"severity": "HIGH"
},
"details": "Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.",
"id": "GHSA-hhj7-6jp7-94j9",
"modified": "2023-09-12T00:30:26Z",
"published": "2023-09-12T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4898"
},
{
"type": "WEB",
"url": "https://github.com/mintplex-labs/anything-llm/commit/dc3dfbf31495fe316b21ee184b9317b38101d30e"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a3dda692-7e8a-44a9-bd96-24cfd3f721d2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HQM6-P3V5-X59R
Vulnerability from github – Published: 2025-11-19 21:31 – Updated: 2025-11-21 00:30
VLAI
Details
A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share codes.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-51663"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-19T20:15:53Z",
"severity": "HIGH"
},
"details": "A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share codes.",
"id": "GHSA-hqm6-p3v5-x59r",
"modified": "2025-11-21T00:30:21Z",
"published": "2025-11-19T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51663"
},
{
"type": "WEB",
"url": "https://github.com/vastsa/FileCodeBox/issues/350"
},
{
"type": "WEB",
"url": "https://github.com/vastsa/FileCodeBox"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HRM3-3XM6-X33H
Vulnerability from github – Published: 2022-12-28 00:30 – Updated: 2023-01-10 15:49
VLAI
Summary
golang-nanoauth authentication bypass vulnerability
Details
Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/nanobox-io/golang-nanoauth"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-20160722212129-ac0cc4484ad4"
},
{
"fixed": "0.0.0-20200131131040-063a3fb69896"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36569"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T18:54:51Z",
"nvd_published_at": "2022-12-27T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.",
"id": "GHSA-hrm3-3xm6-x33h",
"modified": "2023-01-10T15:49:55Z",
"published": "2022-12-28T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36569"
},
{
"type": "WEB",
"url": "https://github.com/nanobox-io/golang-nanoauth/pull/5"
},
{
"type": "WEB",
"url": "https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3"
},
{
"type": "PACKAGE",
"url": "https://github.com/nanobox-io/golang-nanoauth"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2020-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "golang-nanoauth authentication bypass vulnerability"
}
GHSA-HRMX-8JJV-G758
Vulnerability from github – Published: 2024-08-01 21:31 – Updated: 2024-08-07 19:38
VLAI
Summary
Navidrome uses MD5 hashing algorithm
Details
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/navidrome/navidrome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.52.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41259"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-305",
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T13:25:53Z",
"nvd_published_at": "2024-08-01T21:15:36Z",
"severity": "MODERATE"
},
"details": "Use of insecure hashing algorithm in the Gravatar\u0027s service in Navidrome v0.52.3 allows attackers to manipulate a user\u0027s account information.",
"id": "GHSA-hrmx-8jjv-g758",
"modified": "2024-08-07T19:38:27Z",
"published": "2024-08-01T21:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41259"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/d192af10b53a363e2d9e430068333e04"
},
{
"type": "PACKAGE",
"url": "https://github.com/navidrome/navidrome"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Navidrome uses MD5 hashing algorithm"
}
GHSA-HVM9-WC8J-MGRC
Vulnerability from github – Published: 2024-12-18 18:19 – Updated: 2024-12-18 18:19
VLAI
Summary
TShock Security Escalation Exploit
Details
Impact
An issue with the way OTAPI manages client connections results in stale UUIDs remaining on RemoteClient instances after a player disconnects.
Because of this, if the following conditions are met a player may assume the login state of a previously connected player:
1. The server has UUID login enabled
2. An authenticated player disconnects
3. A subsequent player connects with a modified client that does not send the ClientUUID#68 packet during connection
4. The server assigns the same RemoteClient object that belonged to the originally authenticated player to the newly connected player
Patches
TShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.
Workarounds
Implement a RemoteClient reset event handler in a plugin like so:
public override void Initialize()
{
On.Terraria.RemoteClient.Reset += RemoteClient_Reset;
}
private static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)
{
client.ClientUUID = null;
orig(client);
}
Severity
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "TShock"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.21"
},
{
"fixed": "5.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-305",
"CWE-613",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-18T18:19:12Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n orig(client);\n}\n```\n\n",
"id": "GHSA-hvm9-wc8j-mgrc",
"modified": "2024-12-18T18:19:12Z",
"published": "2024-12-18T18:19:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Pryaxis/TShock/security/advisories/GHSA-hvm9-wc8j-mgrc"
},
{
"type": "WEB",
"url": "https://github.com/Pryaxis/TShock/commit/5075997264b48e27960e3446a948ecb0ea0f5a03"
},
{
"type": "PACKAGE",
"url": "https://github.com/Pryaxis/TShock"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "TShock Security Escalation Exploit"
}
GHSA-HW5V-2RVV-67P7
Vulnerability from github – Published: 2023-07-17 15:30 – Updated: 2026-05-26 13:30
VLAI
Details
Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-2959"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-17T14:15:10Z",
"severity": "HIGH"
},
"details": "Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2.",
"id": "GHSA-hw5v-2rvv-67p7",
"modified": "2026-05-26T13:30:10Z",
"published": "2023-07-17T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2959"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0409"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-23-0409"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HW93-RXQ2-MQWW
Vulnerability from github – Published: 2025-07-29 18:30 – Updated: 2025-07-29 18:30
VLAI
Details
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2025-31965"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T17:15:33Z",
"severity": "HIGH"
},
"details": "Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.",
"id": "GHSA-hw93-rxq2-mqww",
"modified": "2025-07-29T18:30:34Z",
"published": "2025-07-29T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31965"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0122906"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J6QM-XGXC-G34G
Vulnerability from github – Published: 2024-02-05 06:30 – Updated: 2024-02-09 03:33
VLAI
Details
In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-20015"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-05T06:15:47Z",
"severity": "HIGH"
},
"details": "In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419.",
"id": "GHSA-j6qm-xgxc-g34g",
"modified": "2024-02-09T03:33:00Z",
"published": "2024-02-05T06:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20015"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J83X-R9QQ-9G4V
Vulnerability from github – Published: 2023-03-10 03:30 – Updated: 2023-03-15 19:17
VLAI
Summary
Froxlor is vulnerable to authentication bypass
Details
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-1307"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-10T22:16:14Z",
"nvd_published_at": "2023-03-10T01:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.",
"id": "GHSA-j83x-r9qq-9g4v",
"modified": "2023-03-15T19:17:36Z",
"published": "2023-03-10T03:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1307"
},
{
"type": "WEB",
"url": "https://github.com/froxlor/froxlor/commit/6777fbf229200f4fd566022e186548391219ab23"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/5fe85af4-a667-41a9-a00d-f99e07c5e2f1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Froxlor is vulnerable to authentication bypass"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.