Common Weakness Enumeration

CWE-302 Authentication Bypass by Assumed-Immutable Data

Description

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-302 ordered by modification date.

9 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-c8w2-fgvx-vhv4	CVE-2026-61682	CRITICAL	golang/github.com/kcp-dev/kcp	kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace	2026-09-18
GHSA-2p3q-h3hg-jcqq	CVE-2026-47303	HIGH	nuget/Microsoft.AspNetCore.Authentication.Negotiate	Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability	2026-07-21
GHSA-qvw7-jm5c-6hqw	CVE-2026-50528	HIGH	nuget/Microsoft.NetCore.App.Runtime.linux-arm nuget/Microsoft.NetCore.App.Runtime.linux-arm64 nuget/Microsoft.NetCore.App.Runtime.linux-musl-arm nuget/Microsoft.NetCore.App.Runtime.linux-musl-arm64 nuget/Microsoft.NetCore.App.Runtime.linux-musl-x64 nuget/Microsoft.NetCore.App.Runtime.linux-x64 nuget/Microsoft.NetCore.App.Runtime.osx-arm64 nuget/Microsoft.NetCore.App.Runtime.osx-x64 nuget/Microsoft.NetCore.App.Runtime.win-arm nuget/Microsoft.NetCore.App.Runtime.win-arm64 nuget/Microsoft.NetCore.App.Runtime.win-x64 nuget/Microsoft.NetCore.App.Runtime.win-x86	Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability	2026-07-20
GHSA-3j3q-wp9x-585p	CVE-2026-39429	HIGH	golang/github.com/kcp-dev/kcp	kcp's cache server is accessible without authentication or authorization checks	2026-04-09
GHSA-6mq3-xmgp-pjm5	CVE-2026-27840	MODERATE	golang/github.com/zitadel/zitadel	ZITADEL's truncated opaque tokens are still valid	2026-02-27
GHSA-f697-gm3h-xrf9	CVE-2024-43441	CRITICAL	maven/org.apache.hugegraph/hugegraph-server	Apache HugeGraph-Server: Fixed JWT Token (Secret)	2025-01-02
GHSA-g95v-3pj6-j433	CVE-2024-3462	LOW	maven/io.antmedia/ant-media-server	Ant Media Server does not properly authorize non-administrative API calls	2024-11-07
GHSA-3vmm-7h4j-69rm	CVE-2023-47127	MODERATE	-	TYPO3 vulnerable to Weak Authentication in Session Handling	2023-12-15
GHSA-jfp7-79g7-89rf	CVE-2022-23501	MODERATE	-	TYPO3 CMS vulnerable to Weak Authentication in Frontend Login	2022-12-13