CWE-303 Incorrect Implementation of Authentication Algorithm

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

LiteLLM: MCP Proxy Has Improper Authentication

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured

CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC

Prometheus vulnerable to basic authentication bypass

Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw

Tillitis TKey Client has an Error in Protocol Implementation

Mattermost fails to properly validate login method restrictions

Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit

Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm

Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication

Mattermost fails to to verify the token used during code exchange

Python Social Auth - Django has unsafe account association

ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

Apache Kafka's SCRAM implementation Incorrectly Implements Authentication Algorithm

SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

Mattermost fails to properly invalidate personal access tokens upon user deactivation

Mattermost fails to clear Google OAuth credentials

Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm

Saltstack Salt Unauthenticated Arbitrary Code Execution