Common Weakness Enumeration

CWE-1390 Weak Authentication

Description

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-1390 ordered by modification date.

6 reviewed records
Advisory ID NVD ID Severity PURLs Summary Last Modified
GHSA-qxvm-r42f-5p8j - HIGH -

AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin

 2026-05-15
GHSA-qqcj-rghw-829x CVE-2026-27478 CRITICAL
maven/io.unitycatalog/unitycatalog-server

Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation

 2026-05-11
GHSA-2865-hh9g-w894 CVE-2025-24070 HIGH
nuget/Microsoft.AspNetCore.App.Runtime.linux-arm nuget/Microsoft.AspNetCore.App.Runtime.linux-arm64 nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 nuget/Microsoft.AspNetCore.App.Runtime.linux-musl-x64 nuget/Microsoft.AspNetCore.App.Runtime.linux-x64 nuget/Microsoft.AspNetCore.App.Runtime.osx-arm64 nuget/Microsoft.AspNetCore.App.Runtime.osx-x64 nuget/Microsoft.AspNetCore.App.Runtime.win-arm nuget/Microsoft.AspNetCore.App.Runtime.win-arm64 nuget/Microsoft.AspNetCore.App.Runtime.win-x64 nuget/Microsoft.AspNetCore.App.Runtime.win-x86 nuget/Microsoft.AspNetCore.Identity

Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability

 2025-10-23
GHSA-p89h-p4ph-4vj6 CVE-2025-47889 HIGH
maven/org.jenkins-ci.plugins/wso2id-oauth

Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

 2025-05-16
GHSA-vxm9-8mfw-vc6g CVE-2025-1293 HIGH
golang/github.com/hashicorp-forge/hermes

Hermes improperly validates a JWT

 2025-02-20
GHSA-pwh8-58vv-vw48 CVE-2023-41900 LOW
maven/org.eclipse.jetty/jetty-openid

Jetty's OpenId Revoked authentication allows one request

 2024-09-10