CWE-1390
CVEs classified under CWE-1390, newest first.
32 CVEsRSS
CVE-2026-110475Critical· 9.3Improper Authentication Vulnerability in CreditNirvana Collections Platform
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulat…
CVE-2026-88101High· 7.8Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
CVE-2026-85939Medium· 5.3Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.
Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.
CVE-2026-85922High· 7.4Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-85376High· 7.8Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
CVE-2026-85328High· 7.0Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-85323Medium· 6.8Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.
Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.
CVE-2026-83840High· 7.8Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
Weak authentication in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-83681Medium· 5.5Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
CVE-2026-83674High· 8.1Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-83657Medium· 5.5Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
Weak authentication in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
CVE-2026-83586High· 7.8Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
CVE-2026-83511High· 7.4Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-70005Medium· 5.9Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69982Medium· 5.9Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69802High· 8.1Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
CVE-2026-96940High· 8.8PoCWeak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-93355High· 8.1PoCLiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentic…
LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentic…
CVE-2026-92289Critical· 9.1PoC⚖ disputedLemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaD…
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaD…
CVE-2026-92288Critical· 9.1PoC⚖ disputedLemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Re…
Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Re…
CVE-2026-94455High· 7.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on th…
CVE-2026-77483High· 8.8Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-73025Critical· 9.8Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-62895High· 8.8Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-80219High· 8.7Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
CVE-2026-73819Critical· 9.8Ebyte NA111-M Weak Authentication
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network …
CVE-2026-44476Medium· 6.3PoCDoorkeeper is an OAuth 2 provider for Ruby on Rails
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain …
CVE-2026-59135Medium· 5.5Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
Weak authentication in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
CVE-2026-55040Critical· 9.1CISA KEVPoCMicrosoft SharePoint Server Security Feature Bypass Vulnerability
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-0274Critical· 9.1An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.
An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.