The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
Volume of CVEs assigned to CWE-289 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
36 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-9701CRITICAL The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the passwo | Jul 8, 2026 | 9.8 | 41 | NO | NO |
CVE-2026-39858CRITICAL Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's For | Apr 30, 2026 | 10.0 | 41 | NO | NO |
CVE-2024-56511CRITICAL DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be b | Jan 10, 2025 | 9.8 | 39 | NO | NO |
CVE-2021-34746CRITICAL A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, re | Sep 2, 2021 | 9.8 | 39 | NO | NO |
CVE-2026-56091HIGH When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to | Jun 25, 2026 | 8.2 | 37 | NO | NO |
CVE-2026-50627CRITICAL The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be | Jun 12, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-44492HIGH Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 addre | Jun 11, 2026 | 8.6 | 37 | NO | NO |
CVE-2026-48618MEDIUM A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname | Jun 26, 2026 | 6.5 | 36 | NO | NO |
CVE-2026-53622CRITICAL Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthentic | Jun 23, 2026 | 10.0 | 36 | NO | NO |
CVE-2026-55075HIGH Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained | Jul 7, 2026 | 7.4 | 34 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.