Common Weakness Enumeration
CWE-305
AllowedAuthentication Bypass by Primary Weakness
Abstraction: Base · Status: Draft
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
304 vulnerabilities reference this CWE, most recent first.
GHSA-HRM3-3XM6-X33H
Vulnerability from github – Published: 2022-12-28 00:30 – Updated: 2023-01-10 15:49
VLAI
Summary
golang-nanoauth authentication bypass vulnerability
Details
Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/nanobox-io/golang-nanoauth"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-20160722212129-ac0cc4484ad4"
},
{
"fixed": "0.0.0-20200131131040-063a3fb69896"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36569"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T18:54:51Z",
"nvd_published_at": "2022-12-27T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.",
"id": "GHSA-hrm3-3xm6-x33h",
"modified": "2023-01-10T15:49:55Z",
"published": "2022-12-28T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36569"
},
{
"type": "WEB",
"url": "https://github.com/nanobox-io/golang-nanoauth/pull/5"
},
{
"type": "WEB",
"url": "https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3"
},
{
"type": "PACKAGE",
"url": "https://github.com/nanobox-io/golang-nanoauth"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2020-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "golang-nanoauth authentication bypass vulnerability"
}
GHSA-HRMX-8JJV-G758
Vulnerability from github – Published: 2024-08-01 21:31 – Updated: 2024-08-07 19:38
VLAI
Summary
Navidrome uses MD5 hashing algorithm
Details
Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/navidrome/navidrome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.52.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41259"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-305",
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T13:25:53Z",
"nvd_published_at": "2024-08-01T21:15:36Z",
"severity": "MODERATE"
},
"details": "Use of insecure hashing algorithm in the Gravatar\u0027s service in Navidrome v0.52.3 allows attackers to manipulate a user\u0027s account information.",
"id": "GHSA-hrmx-8jjv-g758",
"modified": "2024-08-07T19:38:27Z",
"published": "2024-08-01T21:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41259"
},
{
"type": "WEB",
"url": "https://gist.github.com/nyxfqq/d192af10b53a363e2d9e430068333e04"
},
{
"type": "PACKAGE",
"url": "https://github.com/navidrome/navidrome"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Navidrome uses MD5 hashing algorithm"
}
GHSA-HVM9-WC8J-MGRC
Vulnerability from github – Published: 2024-12-18 18:19 – Updated: 2024-12-18 18:19
VLAI
Summary
TShock Security Escalation Exploit
Details
Impact
An issue with the way OTAPI manages client connections results in stale UUIDs remaining on RemoteClient instances after a player disconnects.
Because of this, if the following conditions are met a player may assume the login state of a previously connected player:
1. The server has UUID login enabled
2. An authenticated player disconnects
3. A subsequent player connects with a modified client that does not send the ClientUUID#68 packet during connection
4. The server assigns the same RemoteClient object that belonged to the originally authenticated player to the newly connected player
Patches
TShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.
Workarounds
Implement a RemoteClient reset event handler in a plugin like so:
public override void Initialize()
{
On.Terraria.RemoteClient.Reset += RemoteClient_Reset;
}
private static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)
{
client.ClientUUID = null;
orig(client);
}
Severity
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "TShock"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.21"
},
{
"fixed": "5.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-305",
"CWE-613",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-18T18:19:12Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nAn issue with the way OTAPI manages client connections results in stale UUIDs remaining on `RemoteClient` instances after a player disconnects.\n\nBecause of this, if the following conditions are met a player may assume the login state of a previously connected player:\n1. The server has UUID login enabled\n2. An authenticated player disconnects\n3. A subsequent player connects with a modified client that does not send the `ClientUUID#68` packet during connection\n4. The server assigns the same `RemoteClient` object that belonged to the originally authenticated player to the newly connected player\n\n\n### Patches\nTShock 5.2.1 hotfixes this issue. A more robust fix will be made to OTAPI itself.\n\n### Workarounds\nImplement a RemoteClient reset event handler in a plugin like so:\n```csharp\npublic override void Initialize()\n{\n On.Terraria.RemoteClient.Reset += RemoteClient_Reset;\n}\n\nprivate static void RemoteClient_Reset(On.Terraria.RemoteClient.orig_Reset orig, RemoteClient client)\n{\n\tclient.ClientUUID = null;\n orig(client);\n}\n```\n\n",
"id": "GHSA-hvm9-wc8j-mgrc",
"modified": "2024-12-18T18:19:12Z",
"published": "2024-12-18T18:19:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Pryaxis/TShock/security/advisories/GHSA-hvm9-wc8j-mgrc"
},
{
"type": "WEB",
"url": "https://github.com/Pryaxis/TShock/commit/5075997264b48e27960e3446a948ecb0ea0f5a03"
},
{
"type": "PACKAGE",
"url": "https://github.com/Pryaxis/TShock"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "TShock Security Escalation Exploit"
}
GHSA-HW5V-2RVV-67P7
Vulnerability from github – Published: 2023-07-17 15:30 – Updated: 2026-05-26 13:30
VLAI
Details
Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2023-2959"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-17T14:15:10Z",
"severity": "HIGH"
},
"details": "Authentication Bypass by Primary Weakness vulnerability in Oliva Expertise Oliva Expertise EKS allows Collect Data as Provided by Users.This issue affects Oliva Expertise EKS: before 1.2.",
"id": "GHSA-hw5v-2rvv-67p7",
"modified": "2026-05-26T13:30:10Z",
"published": "2023-07-17T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2959"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0409"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-23-0409"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HW93-RXQ2-MQWW
Vulnerability from github – Published: 2025-07-29 18:30 – Updated: 2025-07-29 18:30
VLAI
Details
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
Severity
8.2 (High)
{
"affected": [],
"aliases": [
"CVE-2025-31965"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T17:15:33Z",
"severity": "HIGH"
},
"details": "Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.",
"id": "GHSA-hw93-rxq2-mqww",
"modified": "2025-07-29T18:30:34Z",
"published": "2025-07-29T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31965"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0122906"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J6QM-XGXC-G34G
Vulnerability from github – Published: 2024-02-05 06:30 – Updated: 2024-02-09 03:33
VLAI
Details
In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-20015"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-05T06:15:47Z",
"severity": "HIGH"
},
"details": "In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419.",
"id": "GHSA-j6qm-xgxc-g34g",
"modified": "2024-02-09T03:33:00Z",
"published": "2024-02-05T06:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20015"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J83X-R9QQ-9G4V
Vulnerability from github – Published: 2023-03-10 03:30 – Updated: 2023-03-15 19:17
VLAI
Summary
Froxlor is vulnerable to authentication bypass
Details
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-1307"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-10T22:16:14Z",
"nvd_published_at": "2023-03-10T01:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.",
"id": "GHSA-j83x-r9qq-9g4v",
"modified": "2023-03-15T19:17:36Z",
"published": "2023-03-10T03:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1307"
},
{
"type": "WEB",
"url": "https://github.com/froxlor/froxlor/commit/6777fbf229200f4fd566022e186548391219ab23"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/5fe85af4-a667-41a9-a00d-f99e07c5e2f1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Froxlor is vulnerable to authentication bypass"
}
GHSA-JH6M-3PQW-242H
Vulnerability from github – Published: 2022-02-09 00:56 – Updated: 2022-08-12 20:52
VLAI
Summary
Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers
Details
A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
Severity
7.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/keycloak/keycloak-gatekeeper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14359"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-01T16:13:00Z",
"nvd_published_at": "2021-02-23T13:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.",
"id": "GHSA-jh6m-3pqw-242h",
"modified": "2022-08-12T20:52:13Z",
"published": "2022-02-09T00:56:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14359"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/12934"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1868591"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak-gatekeeper"
},
{
"type": "WEB",
"url": "https://issues.jboss.org/browse/KEYCLOAK-14090"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20190613000352/github.com/keycloak/keycloak-gatekeeper"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers"
}
GHSA-JP3F-X449-4Q75
Vulnerability from github – Published: 2026-05-18 09:31 – Updated: 2026-06-01 15:04
VLAI
Summary
Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow
Details
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "11.5.0"
},
{
"fixed": "11.5.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.11.0"
},
{
"fixed": "10.11.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0-20260318173148-e9ae890a013b"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.3.2-0.20260318173148-e9ae890a013b"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6334"
],
"database_specific": {
"cwe_ids": [
"CWE-305"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-01T15:04:48Z",
"nvd_published_at": "2026-05-18T08:16:14Z",
"severity": "LOW"
},
"details": "Mattermost versions 11.5.x \u003c= 11.5.1, 10.11.x \u003c= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a different client via a crafted token exchange request.. Mattermost Advisory ID: MMSA-2026-00570",
"id": "GHSA-jp3f-x449-4q75",
"modified": "2026-06-01T15:04:49Z",
"published": "2026-05-18T09:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6334"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/e9ae890a013bb57989fcbdb548d8b7b86b240237"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost doesn\u0027t enforce client identity binding during the OAuth authorization code redemption flow"
}
GHSA-JVR3-FJ9R-5Q66
Vulnerability from github – Published: 2023-09-06 18:30 – Updated: 2025-11-04 21:30
VLAI
Details
Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-4498"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-305"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-06T17:15:50Z",
"severity": "MODERATE"
},
"details": "Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access to pages that in turn should be accessible to authenticated users only",
"id": "GHSA-jvr3-fj9r-5q66",
"modified": "2025-11-04T21:30:39Z",
"published": "2023-09-06T18:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4498"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/304455"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/304455"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.