CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Description
A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-757 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-rqf5-2wxv-rjf4 | CVE-2026-107231 | HIGH |
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext |
2026-10-08 | |
| GHSA-j92g-9f8w-j867 | CVE-2026-54291 | HIGH |
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms |
2026-07-21 | |
| GHSA-9h47-pqcx-hjr4 | - | HIGH |
Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default |
2026-07-07 | |
| GHSA-p9jg-fcr6-3mhf | CVE-2026-53712 | HIGH |
OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms |
2026-07-01 | |
| GHSA-4v55-cpmv-3vcm | CVE-2026-54780 | LOW |
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass |
2026-06-19 | |
| GHSA-rrj9-5q2j-4gvr | CVE-2026-48747 | MODERATE | - |
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade |
2026-06-15 |
| GHSA-v638-38fc-rhfv | CVE-2026-6550 | MODERATE |
AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache |
2026-04-24 | |
| GHSA-h92m-42h4-82f6 | CVE-2019-16791 | HIGH |
postfix-mta-sts-resolver Algorithm Downgrade vulnerability |
2024-10-21 |