CWE-304

52 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 11High 24Medium 15Low 2Not scored 0

CVEs per yearBy the year they were published

CVE-2026-123297
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
JetBrains · Hub
Medium6.8
CVE-2026-119776
frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses
frrouting · frrouting
Medium6.1
CVE-2026-77800
Authentication bypass vulnerability
Zohocorp · ManageEngine Key Manager Plus
High7.7
CVE-2026-113438
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If…
Implem Inc. · Pleasanter
Medium6.9
CVE-2026-101296
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
Apache Software Foundation · Apache Tomcat
Critical9.1
CVE-2026-89068
MOVEit Transfer Authentication bypass in LDAP sign-on
Progress · MOVEit Transfer
High8.1
CVE-2026-73535
Gitea second-factor bypass through OpenID identity linking
Gitea · Gitea
High8.8
CVE-2026-108071
Improper Multi-Factor Authentication Validation Allows Authentication Bypass
TSplus · TSplus Remote Access
High8.7
CVE-2026-93994
Apache MINA SSHD: Repeated-publickey policy bypass on server
Apache Software Foundation · Apache MINA SSHD
High8.1
CVE-2026-94052
Apache MINA SSHD: LDAP password authentication ineffective
Apache Software Foundation · Apache MINA SSHD
Critical9.1