CWE-287 Improper Authentication

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

pyLoad has an authentication bypass in API key validation (check_apikey cache)

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

Duplicate Advisory: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Backstage: Improper authentication in the OIDC provider

PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

Duplicate Advisory: PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents

wger: API credentials remain valid after logout/password change

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

User impersonation due to incorrect handling of the login JWT

Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

social-auth-core has an Improper Authentication issue

phpMyFAQ's two-factor authentication login bypasses the password factor

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

nginx ignition has TOTP Reuse During Validity Window

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState