CWE-1390
CWE-1390 · 27 records · 1 with a public proof-of-concept
Records the NVD classes under CWE-1390, highest CVSS first.
- CRITICAL 9.1CVE-2026-92289
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE s…
- CRITICAL 9.1CVE-2026-92288
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. checkEndP…
- HIGH 8.8CVE-2026-115967
Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: from n/a through 1.8.78.
- HIGH 8.8CVE-2026-96940
An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick…
- HIGH 8.1CVE-2026-83674
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- HIGH 8.1CVE-2026-69802
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
- HIGH 8.1CVE-2026-93355
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without veri…
- HIGH 7.8CVE-2026-88101
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-85376
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- HIGH 7.8CVE-2026-83840
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-83586
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.6CVE-2026-107244
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before t…
- HIGH 7.6CVE-2026-107241
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface duri…
- HIGH 7.4CVE-2026-85922
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
azure-keyvault-administration · azure-keyvault-certificates · azure-keyvault-keys · azure-keyvault-secrets · azure-keyvault-securitydomain
- HIGH 7.4CVE-2026-83511
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- HIGH 7.1CVE-2025-30414
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
- HIGH 7.1CVE-2026-94455public PoC
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authenti…
- HIGH 7CVE-2026-85328
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2 · windows 11 25h2
- MEDIUM 6.8CVE-2026-85323
Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.
windows 10 1607 · windows 10 1809 · windows server 2012 · windows server 2016 · windows server 2019 · windows server 2022
- MEDIUM 5.9CVE-2026-70005
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- MEDIUM 5.9CVE-2026-69982
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
- MEDIUM 5.5CVE-2026-83681
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
- MEDIUM 5.5CVE-2026-83657
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- MEDIUM 5.3CVE-2026-85939
Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.
- MEDIUM 4.3CVE-2026-121612
Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.
- UNSCOREDCVE-2026-113373
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in a…
- UNSCOREDCVE-2026-110475
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requ…