CWE-1394
27 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 27Published CVEs27 of them scored
- 17Last 12 monthspublished in the last year
- 12Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-85295
Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET
chartbrew · chartbrew
Critical9.8 - CVE-2026-121818
About Time Technologies｜Herowatch Go - Security Misconfiguration
About Time Technologies · Herowatch Go
High8.5 - CVE-2026-120442
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
xianhc · ape-volo-admin
Critical9.3 - CVE-2026-119660
MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
yincongcyincong · MuseBot
Critical9.3 - CVE-2026-92777
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections…
Lenovo · Idea Tab Pro (TB373FU)
Medium5.4 - CVE-2026-111367
BillionMail through 4.9 Forgeable JWTs via Default Signing Key
aaPanel · BillionMail
Medium6.9 - CVE-2020-37281
Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee · Gravitee API Management
Critical9.2 - CVE-2026-72895
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G /…
Siemens · SIMATIC IPC BX-21A
High8.4 - CVE-2026-107177
Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens
ExpressGateway · express-gateway
High7.4 - CVE-2026-75870
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
Punk
Critical9.1